fedora-magazine-newsroom

#121 Using Linux System Roles on Fedora to automate the implementation of Clevis/Tang for automated LUKS volume unlocking
Closed: scheduled by glb. Opened by rlengland.

Closed: scheduled
Reopen Issue

This article will cover how to use the Linux System Roles (https://linux-system-roles.github.io/ ) and also available as the linux-system-roles RPM in Fedora) to automate the implementation of Clevis and Tang. Clevis GitHub - latchset/clevis: Automated Encryption Framework and Tang GitHub - latchset/tang: Tang binding daemon can automate unlocking of LUKS encrypted volumes, including for the root filesystem.

The article will have an example that uses the NBDE client and server Linux System Roles to implement the following in an automated manner:

  • A Raspberry Pi, running Fedora, will operate as the Ansible control node and will have the linux-system-roles RPM package installed
  • The NBDE server Linux System Role (GitHub - linux-system-roles/nbde_server: Ansible role for configuring Network-Bound Disk Encryption servers (e.g. tang)) will automate the installation of Tang on the Raspberry Pi
  • The NBDE client Linux System Role (GitHub - linux-system-roles/nbde_client: Ansible role for configuring Network Bound Disk Encryption clients (e.g. clevis)) will automate the implementation of Clevis on several managed nodes (including Fedora and CentOS Stream nodes).
  • The Firewall Linux System Role (GitHub - linux-system-roles/firewall: Configure firewalld and system-config-firewall) will automate the implementation of the firewall configuration on the Tang server
  • This configuration will enable the managed nodes, which have encrypted root filesystems, to boot up in an automated manner without require someone to manually type in the LUKS passphrase at each boot

https://discussion.fedoraproject.org/t/article-proposal-using-linux-system-roles-to-automate-the-implementation-of-clevis-tang-for-automated-luks-volume-unlocking/38972

Metadata Update from @rlengland:
- Issue tagged with: article, needs-image

Start your article in the Fedora Magazine WordPress instance by selecting the "+ New > Post" dropdown menu in the top menu bar.

When you have your article ready for review please leave a note on the Pagure card with a link to the WordPress article preview and the editors will take a look.

Feel free to use comments on this card to communicate with the editors regarding any questions or issues regarding the article.

Thanks.
Edited by rlengland

Metadata Update from @glb:
- Custom field preview-link adjusted to https://fedoramagazine.org/?p=36537&preview=true

@briansmith: I see that you were working on this article recently and that the conclusion section has been written. Is this article ready for review and publication?

Hi @glb, I sent a copy of the draft to a few people to review and for feedback. I'm hoping to finish it up by early next week.

This article is now ready for review: https://fedoramagazine.org/wp-admin/post.php?post=36537&action=edit

Thanks!

Metadata Update from @glb:
- Custom field editor adjusted to theevilskeleton
- Custom field image-editor adjusted to theevilskeleton

Metadata Update from @glb:
- Custom field publish adjusted to 2022-06-22
theevilskeleton commented

My apologies. I was busy for a couple of days, so I didn't have the time to read. I'm reading right now.
theevilskeleton commented

Okay, I just finished reading. It's a well written article and I enjoyed reading it!

The only change I made so far is replacing double spaces with single spaces in the body. Other than that, I have no complaints about it whatsoever.

@theevilskeleton: Do you think you will be able to get this one imaged and scheduled for publication by 08:00 UTC? I'd like to try to avoid missing too many publications since the readership tends to decline if we don't publish as much and we already missed Monday's scheduled article.

Thanks.
theevilskeleton commented

Sure, and thanks for reminding me about the image.

I'm putting this as a reference: Photo by <a href="https://unsplash.com/@proggga?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText">Mikhail Fesenko</a> on <a href="https://unsplash.com/s/photos/system-administrator?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText">Unsplash</a>
theevilskeleton commented

@glb can you check if everything's good? I schedule for publication too.

LGTM. Thanks.

Issue status updated to: Closed (was: Open)
Issue close_status updated to: scheduled
Metadata

article needs-image

None
None
None
theevilskeleton
theevilskeleton
2022-06-22
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.