YUBIKEY-LUKS-ENROLL(1)

💖 YUBIKEY-LUKS-ENROLL 💖

okay bestie, so this is a page from the General Commands Manual section, and it's called yubikey-luks-enroll — which, no surprise, is the tool that enrolls your YubiKey for usage with LUKS. we love a self-explanatory name, periodt ✨

🌸 NAME 🌸

yubikey-luks-enroll — enroll your yubikey for usage with LUKS

🎀 SYNOPSIS 🎀

yubikey-luks-enroll [ -s 3 ] [ -d /dev/sda6 ] [ -c ]

🦋 DESCRIPTION 🦋

so here's the vibe: you've got a YubiKey with challenge-response enabled on slot 2, and this tool takes that little icon and uses it to add a LUKS / cryptsetup key slot. that's the whole point. main character energy for your disk encryption. 🔥

the way it works is genuinely so cool: your chosen PIN or password, plus your YubiKey, together generate a response — and that response gets added as a key to the cryptsetup disk. two-factor but make it disk unlocking 💅

then, on the next boot, you just insert your YubiKey into a USB slot, enter your password, and boom — disk unlocked. slay. or, alternatively, you can enter any other passphrase that is valid for that disk. options, we love to see them 🫶

✨ OPTIONS ✨

the following options change the behavior of the tool. yes, they're doing the most, and yes, we're grateful 😌

• -h — show a summary of options. little help menu moment, we stan 🙈
• -s — the LUKS slot to save the passphrase to. (default: 7)
• -c — clear the chosen LUKS slot at first. heads up: it clears it before doing anything else, so like… know what you're doing bestie 💀
• -d — the disk device to work with. (default: /dev/sda3)

ngl, the synopsis example uses -s 3 and -d /dev/sda6, but the actual defaults are 7 and /dev/sda3. not me noticing that 😭 just read your own invocation carefully, fr fr.

💜 PREREQUISITES 💜

before you can add the Yubikey to the LUKS slot, you need to initialize your Yubikey first. no skipping steps, bestie 🚫

you can do this two ways:

1. using the privacyIDEA management system, or
2. simply by using the command line — iconic, lowkey the easier one

the following command will create a key for challenges response in Yubikey slot 2:

ykpersonalize -2 -ochal-resp -ochal-hmac -ohmac-lt64 -oserial-api-visible

after this, you can use yubikey-luks-enroll to assign this Yubikey to an LUKS slot. and that's it, that's the whole pipeline 🌈

👑 SEE ALSO 👑

• cryptsetup(1)
• ykpersonalize(1)
• ykchalresp(1)

and that's the page, bestie!! 🎀 this one is from 2015-12-01, and it belongs to the YUBIKEY-LUKS-ENROLL(1) manual page in the General Commands Manual. go forth and encrypt your disks with your little USB friend 💖✨