this post was submitted on 31 Jul 2026

26 points (93.3% liked)

Selfhosted

61070 readers

1063 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

Unlocking LUKS with NitroKey/Yubikey: FIDO2, HMAC-SHA1, or OpenPGP? (thebrainbin.org)

submitted 21 hours ago by modem_down@thebrainbin.org to c/selfhosted@lemmy.world

14 comments fedilink hide all child comments

Crossposted from https://thebrainbin.org/m/linux@lemmy.ml/t/1840283

Which approach do you think is better, and why?

FIDO2

HMAC-SHA1

OpenPGP (alternative guide)

Or do you think there is an even better way to use a hardware security token to unlock drives having LUKS full disk encryption?

top 14 comments

sorted by: hot top controversial new old

[–] libewa@feddit.org 2 points 3 hours ago

I personally use a TPM with Measured Boot (so it doesn‘t give the key to external disks), and have a YubiKey and password as fallback options.

[–] mazzilius_marsti@lemmy.world 2 points 10 hours ago* (last edited 10 hours ago)

i use a yubikey and still have the ability to type my LUKs password in. Yubikey is just more convenience: plug in and it auto type the password field. On Fedora this means it populates the field with asterisks. Still, i think using password is the best method.

With that said, i believe a much better secure layer is something similar to what Novacustoms, Purism attempt to do: verify if somebody else not you try to access the laptop. So far i know of only Dasharo boot and the stuff from Purism that can do these...

So the layout is: Boot verification -> LUKs-> your data

Or if you have the juices and powers: Boot verification -> LUKS -> QuebeOS dom0 -> choose your Quebess.

[–] irmadlad@lemmy.world 3 points 20 hours ago

I just manually type the password in. Not quit as elegant, but does the job.

[–] It_is_gaslighting@discuss.tchncs.de 1 points 19 hours ago (1 children)

FIDO2 is great. Only thing I am scared of is losing it/them. So a backup access becomes the issue IMHO.

[–] esc@piefed.social 2 points 10 hours ago

You can have multiple ways to unlock luks container, what's the issue?

[–] irmadlad@lemmy.world -1 points 17 hours ago

Is there a down vote bot loose on Lemmy? Weirdness.

[+] talkingpumpkin@lemmy.world -12 points 21 hours ago (1 children)

Does this have anything to do with self hosting?

[–] modem_down@thebrainbin.org 4 points 20 hours ago (1 children)

Yes. Here are some common self-hosting scenarios:

Home server containing family files: scans, photos, device backups, ...
Office server containing business files: sensitive documents, device backups, ...
Web or email server containing websites, Fediverse instances, emails, etc

In all those cases, full disk encryption (FDE) is a sensible precaution to protect the data in case the server is physically stolen.

Linux is probably the most common OS kernel for self-hosting. On Linux, LUKS (Linux Unified Key Setup) is probably the best FDE system. It's mature and reliable. But anyone self-hosting a Linux server with LUKS FDE is faced with the question of where to store the keys.

Hardware security tokens (HSTs) are widely considered a safer place for keys than SSDs, HDDs, or USB storage. They follow the smartcard principle: a private key can be written to an HST but not read from it (security vulnerabilities excepted). Instead, they implement cryptographic algorithms to prove possession of the private key. So, anyone self-hosting a Linux server with LUKS FDE should strongly consider storing their private key(s) on an HST.

However, there is more than one way to do that. Hence the question in my OP.

[–] talkingpumpkin@lemmy.world 1 points 11 hours ago (4 children)

If it's a server for self hosting you definitely don't want anything that requires interaction at boot.

There's a project that allows unlocking LUKS with a decryption key retrieved from another machine in your network. I don't recall the name but someone hopefully will.

The idea is that put the key on, say, a raspberry pi zero w that you hide somewhere in your house so that if someone steals your server they don't have the key.

[–] superglue@lemmy.dbzer0.com 1 points 2 hours ago

I haven't actually tried it yet, but on that note, if you have an OpenWRT router you can configure dropbear to unlock it.

[–] JustEnoughDucks@slrpnk.net 2 points 3 hours ago

Some people are fine with down time/inconvenience in exchange for security.

I have my boot drive on a secured USB and LUKS keyfile with the rest of the partitions on an encrypted SSD and data on encrypted HDDs.

In a smash and grab (or fascist government gestapo smash and grab), the server is pretty impossible to steal information from (inject illegal content to in order to fabricate evidence) without the USB and they can't simply inject boot malware either. A network device is almost always findable either by cables or WiFi broadcast analyzing.

[–] modem_down@thebrainbin.org 1 points 6 hours ago

If it's a server for self hosting you definitely don't want anything that requires interaction at boot.

Depends on use-case. If you only plan to boot it when you're physically present, it's fine.

[–] esc@piefed.social 3 points 10 hours ago (1 children)

tang

[–] modem_down@thebrainbin.org 2 points 6 hours ago

tang

Thanks. TIL about Clevis/Tang.