If you have an openwrt compatible router then you can use that as the tang server.
Also you can tell clevis to use both tpm and tang and require both to work.
this post was submitted on 28 Jun 2026
17 points (90.5% liked)
Selfhosted
60426 readers
725 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
The concept sounds interesting. I do wonder how to make this "raid proof" though. Like, how do you make sure the device also becomes unbootable if I̶C̶E̶ ̶F̶a̶s̶c̶i̶s̶t̶s̶ ̶J̶e̶f̶f̶r̶e̶y̶ ̶E̶p̶s̶t̶e̶i̶n̶ ̶Y̶o̶u̶r̶ ̶M̶o̶m̶ ̶F̶r̶o̶n̶t̶e̶x̶ the police comes in and takes both? By now there are dogs able to sniff out PCBs even in walls (apparently they got a distinct smell K9's can be trained on).
Does this software by any chance support two servers that both have only a part of the secret? That way you (and/or someone you trust) could deposit a Pi somewhere else and have some way to remotely disable the boot process.
Not sure raidproof exists. If they get there and it's running, all they need is something that is already connected and can read it, so your surface area is huge. If they know you have things they need, and are aware you are technically competent, They're just going to disconnect network, leave it running and call in pros. Anything is probably enough to get past local LEO, but if the feds come in, they're going to get what they want unless you're rolling your own drivers.
I was assuming devices being shut down. With running ones you're of course right, the lengths e.g. GrapheneOS has to go to secure these are insane.
With home devices you very much could make them shut down, which would of course be necessary. E.g. various deadman switches, physical and logical ones. It sucks how common people have to think about this shit by now… fucking fascists…
Listened to a rather interesting episode of Darknet Diaries the other day about a European cyber crime group. To this day, the FBI has been unable to decrypt the devices. The feds didn't give too many details about the specifics, but what they did share was quite interesting:
- Five layers of encryption, each with unique passwords.
- LUKS root partition presumably tied to TPM2.
- Veracrypt or truecrypt volumes in userland.
- A custom-made encryption toolkit.
From what I gathered, I think the optimal balance of usability and security (especially for a headless machine) would be the following:
- LUKS root volume tied to TPM to protect against cloning of disk. Also, nothing too valuable ever lives on root.
- More important data stored behind a FUSE encryption layer like gocryptfs, these can be easily opened remotely. You can also tie the password to data hidden inside the LUKS volume for effective two-password protection if the volume is not already behind a LUKS layer.
- If your really concerned, add in additional layers as needed. You can tie LUKS to TPM and FIDO, not sure if you can set up a two password mode, but that would be quite nice. You can also (probably) tie FUSE based systems to biometrics like Howdey or fingerprint sensors if you have them. This could also be setup in a kind of two-password mode for a single volume. Realistically, two layers of encryption is overkill, but it's more about ensuring multiple layers of redundancy rather than making it harder to crack.
- I can't recommend systemd because of its numerous security vulnerabilities, but homed does have a neat feature where it will unmount encrypted home volumes when your computer goes to sleep. Not sure how effective or useful it is, but it is a nice feature. Been wanting to see if I can setup something similar on Chimera/Artix with dinit user services.
- Defiantly set up duress key-codes/panic buttons. Likewise, been wanting to write a clone of swaylock with duress code support, but as far as I know, nothing of the sort exists right now.
It is also very much worth noting, even though the FBI never got into the hackers' computers, they had more than enough evidence to convict the lot. Being the defender of a computer system is always a losing battle.
I'm running Tang on a VPS, outside of my homelab. Servers in my homelab set up networking and a dedicated WireGuard tunnel to the VPS from initrd, to be able to talk to Tang, to help unlock the filesystem. The WireGuard tunnel is only allowed from my home ISP's ASN. So if anyone picks up all my equipment from my homelab and walks away with them, they will not be able to boot them up, unless they connect from my ISP's ASN (good luck), or know the passphrase.
Additionally, some of my homelab computers that support TPM also have a TPM pin, so walking away with the disk only, and connecting from my ISP's ASN would still not be enough. This is rather pointless, anyone who walks away with the disk only will likely take the entire computer instead. But it was fun setting it up.
In the not so distant future, I'll update this setup to use Shamir Secret Sharing more, where I'll have three pins: my VPS (via Wireguard), a small computer somewhere else in my apartment, and a third at a neighbour (+ TPM on supporting computers).
Interesting. Never heard of Clevis & Tang. I just type the passphrase in on boot for the LUKs drives, and the same for anything Bitlocker. So, I guess they'd have to get the ol' pipe wrench out.
I just have a KVM that I can unlock LUKS with remotely.
I can access it remotely as my router has a built in Wireguard server so I connect to that and I'm basically on LAN.
What's a KVM? I thought that was a kernel virtual machine, but it seems to mean something else.
Keyboard, video, mouse
Its just another computer remotely accessible that is connected to those ports on whatever you want to monitor. For example, used to enter bios on remote devices
You could also mount a NFS share on boot where a keyfile is stored. No extra service needed.
The benfit of tang is that you don't store the secret on a shared server.
The server has a single keypair that it reuses for every client, and each client has thier own keypair.
The encryption key can only be recovered when the client and server perform thier handshake. And only the client gets the key, the server cannot see it.
I use it on a server. The tang server is on my OpenWRT access point. Works great. As a backup, if unlocking fails or if tang is down, I can SSH into the server and manually enter a decryption key to unlock it.
I used to use them, yes. It’s a pretty solid setup, especially like you say, if the tang server itself requires you enter a password to unlock.
A while ago I moved to tpm and secureboot to auto-unlock my servers on boot. It’s definitely slightly less secure, tpm vulnerabilities or a severe enough vulnerability in one of the network services on the machine and a hacker could get into them. But it’s quite a bit more secure than storing the unlock key on usb, and requires at least some degree of hacking skill to break in.
sbctl makes the process of signing boot files pretty easy, systems-cryptenroll for setting up tpm auto-unlock
Dropbear allows you to remotely unlock LUKS over SSH