diff options
| author | Grigori Goronzy <greg@chown.ath.cx> | 2022-02-18 12:51:00 +0100 |
|---|---|---|
| committer | Grigori Goronzy <greg@chown.ath.cx> | 2022-03-15 21:17:00 +0100 |
| commit | caeb5604f9fd8e7aa43c7a1c853f8a7597240b17 (patch) | |
| tree | 3406f19a3a3975efcb2f9b372833f260f6b98156 /man/systemd-cryptenroll.xml | |
| parent | cryptsetup: add libcryptsetup TPM2 PIN support (diff) | |
| download | systemd-caeb5604f9fd8e7aa43c7a1c853f8a7597240b17.tar.xz systemd-caeb5604f9fd8e7aa43c7a1c853f8a7597240b17.zip | |
cryptenroll: add TPM2 PIN documentation
Diffstat (limited to '')
| -rw-r--r-- | man/systemd-cryptenroll.xml | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/man/systemd-cryptenroll.xml b/man/systemd-cryptenroll.xml index d5fdb54cdd..58a4626768 100644 --- a/man/systemd-cryptenroll.xml +++ b/man/systemd-cryptenroll.xml @@ -300,6 +300,24 @@ </varlistentry> <varlistentry> + <term><option>--tpm2-with-pin=</option><replaceable>BOOL</replaceable></term> + + <listitem><para>When enrolling a TPM2 device, controls whether to require the user to enter a PIN + when unlocking the volume in addition to PCR binding, based on TPM2 policy authentication. Defaults + to <literal>no</literal>. Despite being called PIN, any character can be used, not just numbers. + </para> + + <para>Note that incorrect PIN entry when unlocking increments the + TPM dictionary attack lockout mechanism, and may lock out users for a prolonged time, depending on + its configuration. The lockout mechanism is a global property of the TPM, + <command>systemd-cryptenroll</command> does not control or configure the lockout mechanism. You may + use tpm2-tss tools to inspect or configure the dictionary attack lockout, with + <citerefentry><refentrytitle>tpm2_getcap</refentrytitle><manvolnum>1</manvolnum></citerefentry> and + <citerefentry><refentrytitle>tpm2_dictionarylockout</refentrytitle><manvolnum>1</manvolnum></citerefentry> + commands, respectively.</para></listitem> + </varlistentry> + + <varlistentry> <term><option>--wipe-slot=</option><arg rep="repeat">SLOT</arg></term> <listitem><para>Wipes one or more LUKS2 key slots. Takes a comma separated list of numeric slot |