NAME

       clevis-luks-unlockers - Clevis unlockers overview

OVERVIEW

       Clevis provides unlockers for LUKS volumes which can use LUKS policy:

       • clevis-luks-unlock - Unlocks manually using the command line.

       • dracut - Unlocks automatically during early boot.

       • systemd - Unlocks automatically during late boot.

       • udisks2 - Unlocks automatically in a GNOME desktop session.

       Once  a  LUKS volume is bound using clevis luks bind, it can be unlocked using any of the above unlockers
       without using a password.

MANUAL UNLOCKING

       You can unlock a LUKS volume manually using the following command:

              $ sudo clevis luks unlock -d /dev/sda

       For more information, see clevis-luks-unlock(1).

EARLY BOOT UNLOCKING

       If Clevis integration does not already ship in your initramfs, you may need  to  rebuild  your  initramfs
       with this command:

              $ sudo dracut -f

       Once  Clevis  is  integrated  into your initramfs, a simple reboot should unlock your root volume.  Note,
       however, that early boot integration only works for the root volume.  Non-root  volumes  should  use  the
       late boot unlocker.

       Dracut  will  bring  up  your  network  using DHCP by default.  If you need to specify additional network
       parameters, such as static IP configuration, please consult the dracut documentation.

LATE BOOT UNLOCKING

       You can enable late boot unlocking by executing the following command:

              $ sudo systemctl enable clevis-luks-askpass.path

       After a reboot, Clevis will attempt to unlock all _netdev devices listed in  /etc/crypttab  when  systemd
       prompts for their passwords.  This implies that systemd support for _netdev is required.

DESKTOP UNLOCKING

       When  the  udisks2 unlocker is installed, your GNOME desktop session should unlock LUKS removable devices
       configured with Clevis automatically.  You may need to restart your desktop  session  after  installation
       for the unlocker to be loaded.

SEE ALSO

       clevis-luks-unlock(1) clevis-luks-bind(1)

AUTHORS

       Nathaniel McCallum <npmccallum@redhat.com>.

                                                  October 2017                          CLEVIS-LUKS-UNLOCKERS(7)