{"article":{"slug":"full-disk-encryption-on-fedora-w-tpm2","title":"Full Disk Encryption on Fedora w/ TPM2","subtitle":null,"summary":"A hands-on walkthrough from apalrd's adventures on how LUKS full disk encryption works on Fedora and how to enroll a key into the TPM2 with systemd-cryptenroll, including PCR choices, PIN options, crypttab edits and rebuilding the initramfs, as a first step toward a business-wide Linux rollout.","content_type":"tutorial","language":"en","canonical_url":"https://www.apalrd.net/posts/2026/ent_luks/","author":{"name":"apalrd","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"apalrd's adventures","url":"https://www.apalrd.net/","listing_slug":null,"listing":null},"topics":[{"name":"Linux","slug":"linux","url":"https://listedarticles.com/topics/linux"},{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Tutorials","slug":"tutorials","url":"https://listedarticles.com/topics/tutorials"},{"name":"Privacy","slug":"privacy","url":"https://listedarticles.com/topics/privacy"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":923,"reading_minutes":4,"published_at":"2026-10-22T04:00:05.000Z","added_at":"2026-10-24T23:09:56.357Z","updated_at":"2026-10-24T23:09:56.357Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/full-disk-encryption-on-fedora-w-tpm2","markdown_url":"https://listedarticles.com/articles/full-disk-encryption-on-fedora-w-tpm2.md","example":false,"citation":"apalrd, apalrd's adventures. \"Full Disk Encryption on Fedora w/ TPM2.\" 22 Oct 2026. https://www.apalrd.net/posts/2026/ent_luks/ (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://www.apalrd.net/posts/2026/ent_luks/"},"body_markdown":"Today I’m diving into the world of Secure Boot, TPM2, and all of the complications that come with wanting a high level of security without having to type a disk encryption key all the time. Ultimately, my goal is to come up with a solution that I can roll out in my Linux-based business environment, but today I’m walking you through the basics of how full disk encryption works with LUKS and enrolling your first key into the TPM.\n\n# Contents\n\n- [Video](https://www.apalrd.net/posts/2026/ent_luks/#video)\n- [LUKS Basics](https://www.apalrd.net/posts/2026/ent_luks/#basic-luks-volume)\n- [LUKS Key Slots](https://www.apalrd.net/posts/2026/ent_luks/#managing-key-slots)\n- [TPM-Bound Keys](https://www.apalrd.net/posts/2026/ent_luks/#enrolling-tpm-bound-keys)\n- [Encrypted Root on Fedora](https://www.apalrd.net/posts/2026/ent_luks/#fedora-encrypted-root)\n\n# Video\n\n[![Video Thumbnail](https://www.apalrd.net/posts/2026/ent_luks/thumbnail.png)](https://youtu.be/1LSdRnAtvKA)\n\n# Basic LUKS Volume\n\nTo learn what I’m doing, I’ll create a LUKS-encrypted volume manually. First, though, make sure you have a disk partition to work on:\n\n```\n# If you need to partition your drive, do so with sgdisk\n# Remove existing partition table (MBR + GPT)\n# sudo sgdisk --zap-all /dev/sdX\n# Create new partition table and one partition full size\n# sudo sgdisk -n 1:0:0 -t 1:8309 /dev/sdX\n\n# Or, if you already have a partition table, set the type to 8309 (LUKS) instead of 8300 (LINUX)\n# This is what I did\n# List partition table\nsudo sgdisk -p /dev/sdX\n# Set partition 3 to type \"Linux LUKS\" (8309)\nsudo sgdisk -t 1:8309 /dev/sdX\n```\n\nAfter that, we can format the LUKS partition, then format the ext4 filesystem on top of that partition\n\n```\n# Format your drive partition (mine is mmcblk0p3)\nsudo cryptsetup luksFormat --type luks2 /dev/sdX1\n\n# Inspect the LUKS header (just for fun, really)\nsudo cryptsetup luksDump /dev/sdX1\n\n# Mount the LUKS volume \n# this creates /dev/mapper/vault block device based name we gave it here - vault\nsudo cryptsetup open /dev/sdX1 vault\n\n# Create the filesystem on the LUKS block device, named 'vault'\nsudo mkfs.ext4 -L vault /dev/mapper/vault\n\n# Create mount point, mount, and test the new device\nsudo mkdir -p /mnt/vault\nsudo mount /dev/mapper/vault /mnt/vault\necho \"hello\" | sudo tee /mnt/vault/test.txt\n\n# get status of the volume (for fun)\nsudo cryptsetup status vault\nsudo ls -l /dev/mapper/\n\n# Unmount ext4 and then close the crypt volume\nsudo umount /mnt/vault\nsudo cryptsetup close vault\n```\n\n# Managing Key Slots\n\nIf you want to backup the LUKS header (in case you make a mistake, you can restore the old header with the old keys):\n\n```\n# Backup\nsudo cryptsetup luksHeaderBackup /dev/sdX1 --header-backup-file ~/vault-header.img\n# Restore\nsudo cryptsetup luksHeaderRestore /dev/sdX1 --header-backup-file ~/vault-header.img\n```\n\nThen we have a few options to add keys:\n\n```\n# Add key slot with a passphrase\nsudo cryptsetup luksAddKey /dev/sdX1\n\n# You can also force a keyslot if you want\nsudo cryptsetup luksAddKey --key-slot 5 /dev/sdX1\n\n# Add key which is defined by a keyfile\n# Generate 512 bytes of random as vault.key\n# Obviously protect this key better than your home directory\n# Pass in --key-file to mount it\nsudo dd if=/dev/urandom of=~/vault.key bs=512 count=1\nsudo cryptsetup luksAddKey /dev/sdX1 ~/vault.key\n\n# Just a reminder, you can see how many key slots there are\n# And you can tell what type of keys they have\nsudo cryptsetup luksDump /dev/sdX1\n\n# And you can test your keys using --test-passphrase\nsudo cryptsetup open --test-passphrase /dev/sdX1\n\n# Change a passphrase on a key slot\nsudo cryptsetup luksChangeKey /dev/sdX1\n\n# Remove a key by supplying the key itself\nsudo cryptsetup luksRemoveKey /dev/sdX1\n\n# Remove a key by supplying a different key (specify the slot number)\n# Cannoy delete your own key using this command\nsudo cryptsetup luksKillSlot /dev/sdX1 1\n```\n\n# Enrolling TPM-Bound keys\n\nWe’ll use `systemd-cryptenroll` for this, so make sure it’s working:\n\n```\n# See if we have a working TPM\nsudo systemd-cryptenroll --tpm2-device=list\n```\n\nLet’s now use cryptenroll to add a recovery key - this is randomly generated by systemd, gives you a QR code if you want it. It does not delete existing keys - it just adds a new key using randomness. You don’t have to add recovery keys this way, this is just another way to do it.\n\n```\nsudo systemd-cryptenroll --recovery-key /dev/sdX1\n```\n\nAnd finally, using it to enroll a TPM:\n\n```\n# Bind to TPM PCR 7\nsudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 /dev/sdX1\n\n# Bind to PCR 7 + also require a PIN\nsudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/sdX1\n\n# Show what we just did\nsudo systemd-cryptenroll /dev/sdX1\nsudo cryptsetup luksDump /dev/sdX1\n\n# Also, we can mount manually using this command\nsudo cryptsetup open --token-only /dev/sdX1 vault\n```\n\nIf we are doing this ‘for real’, and want the device auto-unlocked, systemd can manage this for us with the crypttab also:\n\n```\n# Get UUID of vault from luksDump\nsudo cryptsetup luksDump /dev/sdX1\n# Add vault to crypttab\necho 'vault UUID= none tpm2-device=auto,nofail' | sudo tee -a /etc/crypttab\n\n# If you want to mount it immediately without rebooting, do daemon-reload and start\n# The service is 'transient' (generated at runtime), so you can't --enable it\nsudo systemctl daemon-reload\nsudo systemctl start systemd-cryptsetup@vault.service\n\n# If you reboot, the crypto unlock should happen automatically\n```\n\n# Fedora Encrypted Root\n\nFedora’s installer (Anaconda) already sets up the encrypted volume. The passphrase we enter during installation becomes our recovery key. We just need to enroll a new key slot which is TPM bound, optionally using a PIN.\n\n```\n# Bind to PCR 7 + also require a PIN\nsudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/sdX1\n\n# Edit the crypttab entry so it checks the TPM for that crypto volume\nsudo nano /etc/crypttab\n# luks- UUID= none discard,tpm2-device=auto\n# (keep the existing options and add tpm2-device=auto)\n\n# Rebuild the initramfs, making sure the TPM2 module is included\nsudo dracut --force --regenerate-all --add tpm2-tss\n```\n","body_html":"

Today I’m diving into the world of Secure Boot, TPM2, and all of the complications that come with wanting a high level of security without having to type a disk encryption key all the time. Ultimately, my goal is to come up with a solution that I can roll out in my Linux-based business environment, but today I’m walking you through the basics of how full disk encryption works with LUKS and enrolling your first key into the TPM.

\n

Contents

\n\n

Video

\n

\"Video

\n

Basic LUKS Volume

\n

To learn what I’m doing, I’ll create a LUKS-encrypted volume manually. First, though, make sure you have a disk partition to work on:

\n
# If you need to partition your drive, do so with sgdisk\n# Remove existing partition table (MBR + GPT)\n# sudo sgdisk --zap-all /dev/sdX\n# Create new partition table and one partition full size\n# sudo sgdisk -n 1:0:0 -t 1:8309 /dev/sdX\n\n# Or, if you already have a partition table, set the type to 8309 (LUKS) instead of 8300 (LINUX)\n# This is what I did\n# List partition table\nsudo sgdisk -p /dev/sdX\n# Set partition 3 to type "Linux LUKS" (8309)\nsudo sgdisk -t 1:8309 /dev/sdX
\n

After that, we can format the LUKS partition, then format the ext4 filesystem on top of that partition

\n
# Format your drive partition (mine is mmcblk0p3)\nsudo cryptsetup luksFormat --type luks2 /dev/sdX1\n\n# Inspect the LUKS header (just for fun, really)\nsudo cryptsetup luksDump /dev/sdX1\n\n# Mount the LUKS volume \n# this creates /dev/mapper/vault block device based name we gave it here - vault\nsudo cryptsetup open /dev/sdX1 vault\n\n# Create the filesystem on the LUKS block device, named 'vault'\nsudo mkfs.ext4 -L vault /dev/mapper/vault\n\n# Create mount point, mount, and test the new device\nsudo mkdir -p /mnt/vault\nsudo mount /dev/mapper/vault /mnt/vault\necho "hello" | sudo tee /mnt/vault/test.txt\n\n# get status of the volume (for fun)\nsudo cryptsetup status vault\nsudo ls -l /dev/mapper/\n\n# Unmount ext4 and then close the crypt volume\nsudo umount /mnt/vault\nsudo cryptsetup close vault
\n

Managing Key Slots

\n

If you want to backup the LUKS header (in case you make a mistake, you can restore the old header with the old keys):

\n
# Backup\nsudo cryptsetup luksHeaderBackup /dev/sdX1 --header-backup-file ~/vault-header.img\n# Restore\nsudo cryptsetup luksHeaderRestore /dev/sdX1 --header-backup-file ~/vault-header.img
\n

Then we have a few options to add keys:

\n
# Add key slot with a passphrase\nsudo cryptsetup luksAddKey /dev/sdX1\n\n# You can also force a keyslot if you want\nsudo cryptsetup luksAddKey --key-slot 5 /dev/sdX1\n\n# Add key which is defined by a keyfile\n# Generate 512 bytes of random as vault.key\n# Obviously protect this key better than your home directory\n# Pass in --key-file to mount it\nsudo dd if=/dev/urandom of=~/vault.key bs=512 count=1\nsudo cryptsetup luksAddKey /dev/sdX1 ~/vault.key\n\n# Just a reminder, you can see how many key slots there are\n# And you can tell what type of keys they have\nsudo cryptsetup luksDump /dev/sdX1\n\n# And you can test your keys using --test-passphrase\nsudo cryptsetup open --test-passphrase /dev/sdX1\n\n# Change a passphrase on a key slot\nsudo cryptsetup luksChangeKey /dev/sdX1\n\n# Remove a key by supplying the key itself\nsudo cryptsetup luksRemoveKey /dev/sdX1\n\n# Remove a key by supplying a different key (specify the slot number)\n# Cannoy delete your own key using this command\nsudo cryptsetup luksKillSlot /dev/sdX1 1
\n

Enrolling TPM-Bound keys

\n

We’ll use systemd-cryptenroll for this, so make sure it’s working:

\n
# See if we have a working TPM\nsudo systemd-cryptenroll --tpm2-device=list
\n

Let’s now use cryptenroll to add a recovery key - this is randomly generated by systemd, gives you a QR code if you want it. It does not delete existing keys - it just adds a new key using randomness. You don’t have to add recovery keys this way, this is just another way to do it.

\n
sudo systemd-cryptenroll --recovery-key /dev/sdX1
\n

And finally, using it to enroll a TPM:

\n
# Bind to TPM PCR 7\nsudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 /dev/sdX1\n\n# Bind to PCR 7 + also require a PIN\nsudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/sdX1\n\n# Show what we just did\nsudo systemd-cryptenroll /dev/sdX1\nsudo cryptsetup luksDump /dev/sdX1\n\n# Also, we can mount manually using this command\nsudo cryptsetup open --token-only /dev/sdX1 vault
\n

If we are doing this ‘for real’, and want the device auto-unlocked, systemd can manage this for us with the crypttab also:

\n
# Get UUID of vault from luksDump\nsudo cryptsetup luksDump /dev/sdX1\n# Add vault to crypttab\necho 'vault UUID=<luks-uuid> none tpm2-device=auto,nofail' | sudo tee -a /etc/crypttab\n\n# If you want to mount it immediately without rebooting, do daemon-reload and start\n# The service is 'transient' (generated at runtime), so you can't --enable it\nsudo systemctl daemon-reload\nsudo systemctl start systemd-cryptsetup@vault.service\n\n# If you reboot, the crypto unlock should happen automatically
\n

Fedora Encrypted Root

\n

Fedora’s installer (Anaconda) already sets up the encrypted volume. The passphrase we enter during installation becomes our recovery key. We just need to enroll a new key slot which is TPM bound, optionally using a PIN.

\n
# Bind to PCR 7 + also require a PIN\nsudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/sdX1\n\n# Edit the crypttab entry so it checks the TPM for that crypto volume\nsudo nano /etc/crypttab\n#   luks-<uuid> UUID=<uuid> none discard,tpm2-device=auto\n# (keep the existing options and add tpm2-device=auto)\n\n# Rebuild the initramfs, making sure the TPM2 module is included\nsudo dracut --force --regenerate-all --add tpm2-tss
","headings":[{"level":1,"text":"Contents","id":"contents"},{"level":1,"text":"Video","id":"video"},{"level":1,"text":"Basic LUKS Volume","id":"basic-luks-volume"},{"level":1,"text":"Managing Key Slots","id":"managing-key-slots"},{"level":1,"text":"Enrolling TPM-Bound keys","id":"enrolling-tpm-bound-keys"},{"level":1,"text":"Fedora Encrypted Root","id":"fedora-encrypted-root"}]}}