TPM-based automatic LUKS unlocking for a Fedora VM on Proxmox VE

tpm-luks-unlock-fedora-vm-proxmox.md

To set up TPM-based automatic LUKS unlocking for a Fedora VM on Proxmox VE, follow these steps:

Step 1: Proxmox Configuration

1. Shut down the VM.
2. Go to Hardware > Add > TPM State.
3. Select a storage location and ensure version is v2.0.
4. Note: The VM must be using UEFI (OVMF).

---

Step 2: Fedora Configuration

Boot the VM and run the following commands as root:

1. Install TPM package, if required:

sudo dnf install tpm2-tss

2. Bind LUKS to TPM: Identify your encrypted partition (usually /dev/sda3 or similar) using lsblk, then run:

sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+4+7 /dev/sdXN

(Replace /dev/sdXN with your actual partition; enter your current passphrase when prompted.)

3. Edit Crypttab:

Open /etc/crypttab and append tpm2-device=auto to your root disk options: luks-uuid... UUID=... none tpm2-device=auto

4. Rebuild Boot Image:

sudo dracut -f

---

Step 3: Verification

• Reboot the VM.
• The system should now bypass the manual passphrase prompt and proceed directly to the login screen.