Quickstart in Full Disk Encryption with TPM and YaST2
This is a quick start guide for Full Disk Encryption with TPM or FIDO2 and YaST2 on openSUSE MicroOS. It focuses on the few steps to install openSUSE MicroOS with YaST2 and using Full Disk Encryption secured by a TPM2 chip and measured boot or a FIDO2 key.
After editing this file, call sdbootutil update-all-entries to update the bootloader configuration. If that option does not exist yet or does not work, a workaround is: sdbootutil remove-all-kernels && sdbootutil add-all-kernels.
If the prediction system fails, a new policy must be created for the new measurements to replace the policy stored in the TPM2.
If your machine is a VM, it is recommended to remove the “0” from the FDE_SEAL_PCR_LIST variable in /etc/sysconfig/fde-tools. An update of the hypervisor can change PCR0. Since such an update is not visible inside the VM, the PCR values cannot be updated. As result, the disk cannot be decrypted automatically at the next boot, the recovery key needs to be entered and a manual re-enrollment is necessary.
Tags: openSUSE Tumbleweed MicroOS sysadmin rolling release sdbootutil GRUB TPM EFI Full-Disk encryption systemd Btrfs YaST2
