|
 |
8d419f |
From ae4da9f80eb84469b0fbb3e02bfe95751d4513dd Mon Sep 17 00:00:00 2001
|
|
|
8d419f |
From: Grigori Goronzy <greg@chown.ath.cx>
|
|
|
8d419f |
Date: Fri, 18 Feb 2022 12:51:00 +0100
|
|
|
8d419f |
Subject: [PATCH] cryptenroll: add TPM2 PIN documentation
|
|
|
8d419f |
|
|
|
8d419f |
(cherry picked from commit caeb5604f9fd8e7aa43c7a1c853f8a7597240b17)
|
|
|
8d419f |
|
|
|
8d419f |
Related: #2087652
|
|
|
8d419f |
---
|
|
|
8d419f |
man/systemd-cryptenroll.xml | 18 ++++++++++++++++++
|
|
|
8d419f |
1 file changed, 18 insertions(+)
|
|
|
8d419f |
|
|
|
8d419f |
diff --git a/man/systemd-cryptenroll.xml b/man/systemd-cryptenroll.xml
|
|
|
8d419f |
index d5fdb54cdd..58a4626768 100644
|
|
|
8d419f |
--- a/man/systemd-cryptenroll.xml
|
|
|
8d419f |
+++ b/man/systemd-cryptenroll.xml
|
|
|
8d419f |
@@ -299,6 +299,24 @@
|
|
|
8d419f |
signatures likely will validate against pre-existing certificates.</para></listitem>
|
|
|
8d419f |
</varlistentry>
|
|
|
8d419f |
|
|
|
8d419f |
+ <varlistentry>
|
|
|
8d419f |
+ <term><option>--tpm2-with-pin=</option><replaceable>BOOL</replaceable></term>
|
|
|
8d419f |
+
|
|
|
8d419f |
+ <listitem><para>When enrolling a TPM2 device, controls whether to require the user to enter a PIN
|
|
|
8d419f |
+ when unlocking the volume in addition to PCR binding, based on TPM2 policy authentication. Defaults
|
|
|
8d419f |
+ to <literal>no</literal>. Despite being called PIN, any character can be used, not just numbers.
|
|
|
8d419f |
+ </para>
|
|
|
8d419f |
+
|
|
|
8d419f |
+ <para>Note that incorrect PIN entry when unlocking increments the
|
|
|
8d419f |
+ TPM dictionary attack lockout mechanism, and may lock out users for a prolonged time, depending on
|
|
|
8d419f |
+ its configuration. The lockout mechanism is a global property of the TPM,
|
|
|
8d419f |
+ <command>systemd-cryptenroll</command> does not control or configure the lockout mechanism. You may
|
|
|
8d419f |
+ use tpm2-tss tools to inspect or configure the dictionary attack lockout, with
|
|
|
8d419f |
+ <citerefentry><refentrytitle>tpm2_getcap</refentrytitle><manvolnum>1</manvolnum></citerefentry> and
|
|
|
8d419f |
+ <citerefentry><refentrytitle>tpm2_dictionarylockout</refentrytitle><manvolnum>1</manvolnum></citerefentry>
|
|
|
8d419f |
+ commands, respectively.</para></listitem>
|
|
|
8d419f |
+ </varlistentry>
|
|
|
8d419f |
+
|
|
|
8d419f |
<varlistentry>
|
|
|
8d419f |
<term><option>--wipe-slot=</option><arg rep="repeat">SLOT</arg></term>
|
|
|
8d419f |
|