Understanding the pieces

systemd-cryptenroll

The setup

Prerequisites

Step 1: Verify TPM2 is available

Step 2: Identify your LUKS partition

Step 3: Enroll the TPM2 key

Step 4: Update crypttab

Step 5: Rebuild initramfs

Step 6: Reboot

Security model

What breaks the seal

Hardware When I set up Fedora 44 on my Predator Helios Neo 16, I enabled full disk encryption using LUKS. Non-negotiable for a cybersecurity student. The problem: every boot starts with a password prompt before anything loads. Fine in principle, friction in practice — especially when you're rebooting frequently during a fresh system setup. The solution: seal the decryption key inside the TPM chip and let the hardware unlock the drive automatically on legitimate boots. No password prompt, full encryption intact. This is how I set it up. LUKS (Linux Unified Key Setup) is the standard disk encryption layer on Linux. When enabled, your entire partition is encrypted at rest. Before the OS can boot, something needs to provide the decryption key — normally that's you, typing a passphrase. LUKS2 (the modern version, default on Fedora) supports multiple keyslots and tokens. Think of keyslots as different keys to the same lock — you can have a passphrase keyslot and a TPM keyslot simultaneously. Either one unlocks the drive. TPM (Trusted Platform Module) is a dedicated security chip on your motherboard. It's not software — it's physical hardware that stores cryptographic secrets and enforces conditions on when those secrets are

released. The relevant capability here: the TPM can seal a secret to specific system state measurements. It will only release that secret if the system is in the expected state. Move the SSD to another machine? No TPM. Different hardware state? Key not released. Your data stays encrypted. PCR stands for Platform Configuration Register. These are values inside the TPM that represent measurements of different stages of your boot process — fingerprints of your firmware, bootloader, Secure Bootconfiguration, and so on. When you seal a key to a PCR, you're saying: "only release this key if PCR X has this exact value." The key relevant PCRs: I bound to PCR 7 — the Secure Boot state. This means: systemd-cryptenroll is a tool built directly into systemd for enrolling hardware security tokens — including TPM2 — as LUKS keyslots. I initially tried clevis, the older and more commonly documented approach. The bind command ran without errors, the tokens appeared in the LUKS dump, dracut rebuilt successfully — but the password prompt keptappearing at boot. After debugging, the clevis dracut module simply wasn't making it into the initramfs reliably on Fedora 44. systemd-cryptenroll solved it on the first try. On Fedora 44 with modern systemd, it's the right tool — tighter initramfs integration, no additional packages needed, and it just works. The tpm_crb driver is the Intel TPM 2.0 on the i9-13900HX platform.If you see output here, you're good. The partition is /dev/nvme0n1p7, UUID 67669a3d-.... Note your UUID— you'll need it. Enter your existing LUKS passphrase when prompted. This authorizes adding a new keyslot. The command: Your original passphrase keyslot is untouched. Verify the enrollment: You should see a systemd-tpm2 token entry. Change the line from: Two changes: none becomes - (means "no keyfile, use token"), andtpm2-device=auto,tpm2-pcrs=7 is appended to the options. This tellsthe initramfs to attempt TPM2 unlock before falling back to passphrase. This rebuilds the initramfs for all installed kernels, baking in the TPM2 unlock logic. Let it complete fully before rebooting. The boot sequence should now go straight from GRUB to the KDE login screen — no passphrase prompt. The TPM provides the key automaticallyduring the initramfs stage. This setup gives you encryption at rest against the realistic threat:physical theft of the device or SSD. Not protected against: The passphrase remains your fallback. If the TPM fails, if you flash firmware, or if Secure Boot state changes, the TPM unlock breaks andyou'll be prompted for the passphrase. Enter it, boot normally, then re-run the systemd-cryptenroll command to re-seal to the new state. These events change PCR 7 and will require re-enrollment: When this happens: passphrase at boot → login → re-run step 3 → rebuild initramfs → done. Acer Predator Helios Neo 16Intel i9-13900HX · RTX 4060 · 16GB RAM · 1TB NVMe

Fedora Linux 44 (KDE Plasma Desktop Edition) Templates let you quickly answer FAQs or store snippets for re-use. Hide child comments as well For further actions, you may consider blocking this person and/or reporting abuse