I'm trying to use a Yubikey 4 as a second factor to access a LUKS-encrypted USB HDD. Here's how far I've gotten:
I'm using yubikey-luks to add my HMAC-SHA1 hashed password to slot 7 of the device.
- Problem: cryptsetup only challenges the yubikey on boot, and I'm opening the device once logged in.
However, I can use
ykchalresp to manually challenge my Yubikey.
- That involves inputing my passphrase in plain text into a terminal.
- Even if I get past that, I don't know a way to conveniently pipe/input that to cryptsetup.
I've thought of writing the hashed passphrase to a file and using it as
--key-file, but that sounds like a bad idea since I'll have the key to my device laying around.
Please let me know if I'm formatting a command wrong, or if you have a way around any of my problems!