On 06/04/2017 10:03 PM, [email protected] wrote: > When using a usb-vm, my usb keyboard is not accessible at boot time, > and thus my disk encryption password must be typed on the built-in > keyboard. > > When not using a usb-vm, a usb keyboard can be used to enter the disk > encryption password. > > When using a simple static password at boot typed by the yubikey (which > acts like a keyboard), it has the same limitations as the usb keyboard, > wherein it can't type the disk password when a usb-vm is being used. > > I could not determine whether the documentation discussing > challenge-response addresses this problem with boot-time disk passwords > as some sub-component ( https://www.qubes-os.org/doc/yubi-key/ ). I only > see the screensaver discussed, but not disk passwords at boot. > > While still using a usb-vm to manage all usb devices, is there any way > to authorize the yubikey automatically at boot time so it can type in > a password for me? > > Also, here: ( https://github.com/adubois/qubes-app-linux-yubikey), am I > missing the referenced qubes-yubikey-vm and qubes-yubikey-dom0 in the > repos, because they don't seem to exist? > > Thanks!
With USB VM enabled, all USB devices are hidden from dom0 even during the Linux kernel boot (but not before). If you need to use USB devices during Qubes OS boot (keyboard, yubikey, anti-evil-maid, ...) and don't mind rigorously checking nobody has plugged any suspicious USB devices into your machine before powering it on (as you should be doing anyway), you can follow the steps outlined below. There's a Linux kernel command line argument you need to remove from /etc/default/grub -- find the line starting with "GRUB_CMDLINE_LINUX" and drop the "rd.qubes.hide_all_usb" argument. Save the changes and rebuild grub configuration using `sudo grub2-mkconfig -o /boot/grub2/grub.cfg` and then reboot. Please note that if you have anti-evil-maid installed, you also need to re-run `anti-evil-maid-install` script on your AEM device. Unsealing of your secrets will, as expected, fail during next boot. Once you reboot without this option, you can use any USB device normally. Cheers, Patrik -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/9133995a-ada3-c4d0-fd21-8fb5c76e8c2e%40gmail.com. For more options, visit https://groups.google.com/d/optout.
signature.asc
Description: OpenPGP digital signature
