Ubuntu Server 26.04 could benefit hugely with what Canonical did to Ubuntu Desktop 26.04 for TPM-backed FDE

Lounge
,
1

Mods — I wasn’t sure in which category to post this, so please move if applicable.

From a security and usability standpoint, I love what Canonical has done by incorporating the security tenets of Ubuntu Core into Ubuntu Desktop 26.04. The new mechanism for TPM-backed full-disk encryption (FDE) has taken me plenty of learning (I’ve still a long way to go), but it works flawlessly; I can work with the basics; and it all makes sense.

(Side note: For the snap-haters, tough luck — you’re missing out! What Canonical’s devs have done with this is impressive.)

Ubuntu Server 26.04 could do with the same!

At the moment, my home server doesn’t use LUKS encryption, because if the server has to restart (eg after a power failure), I have to enter the LUKS password in order to be able to start up.

I could do this by physically going to the computer, and attaching a monitor and keyboard. Or, I could install something like Dropbear to allow me to SSH into the machine from my phone to enter the passphrase. But that means that (a) I have to know that the server needs rebooting, and (b) I have to be available — not fast asleep, travelling, or in the hospital (as I recently was).

It’s also a serious problem if the server is stolen, because the drive isn’t protected with LUKS.

If the Ubuntu Server 26.04 had used the same TPM-backed FDE mechanism as the desktop does, it wouldn’t have those problems. The server could still use LUKS encryption plus the inherent security that Core provides, yet be able to reboot without me.

Question

Does Canonical intend to bring Ubuntu Core into Ubuntu Server the same way as it did with Ubuntu Desktop? I hope so.

Comment

With loads of help from people here and from AI, I’ve managed to figure out how to convert Ubuntu Server 26.04 into a TPM-backed FDE.

But.

This still isn’t secure against theft, because unlike the method used for Ubuntu Desktop 26.04, it still uses the old Grub method to boot. This lets an attacker go directly into Recovery Mode without requiring a login password.

I don’t suppose that there’s a way to install or convert Ubuntu Server 26.04 with the same level of security?

3 Likes
2

I vaguely remember someone saying that Desktop TPM/FDE is just bringing to the desktop the same functionality that’s been available and tested on the server side for a while — I just can’t find the source. Or my memory is playing tricks on me and it was something else; perhaps server users running Ubuntu Core.

In case you’ve missed it, here is something from the server docs:

I cannot claim to understand a whole lot about TPM measurements, but perhaps they can be leveraged to prevent the password-less recovery mode: only the default kernel command line would be measured and thus allowed to unlock the disk; recovery mode would thus require the recovery key, or something like that. But I wouldn’t trust myself to get that right without leaving some window ajar while bolting the front door shut. :wink:

Have you considered installing Ubuntu Core on your server?

1 Like
3

That’s definitely incorrect for 26.04. The Server completely lacks the new security system that the Desktop has.

Oh, I wish that I’d found that few days ago! I’ve been figuring out a workaround (which does work — I finished up only half-an-hour ago!), and Clevis, if it works, would have saved me ages.

I’m definitely going to test it to see how well it works. Thank you for the link.

I have tried more than once to install Ubuntu Core, and asked the community for help, and got nowhere. At the moment, Ubuntu Core is specifically for IoT, which could explain why I can’t install it — I’m not using an IoT device. If you wish to give it a bash, let me know whether or not you succeed, please.

There’s also Ubuntu Desktop Core, which is Ubuntu Core for the Desktop. Originally, the beta was scheduled for the end of last year, but development stalled. I haven’t tried it for a few months, but when I did try, I couldn’t get anywhere with it.

1 Like
4

Well, IoT is a very flexible term. :wink: I just chose to make my VM a “T” of the “I”. :grin:

$ ssh -i ~/.ssh/id_ubuntu_one peterwhite23@192.168.122.176

The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

Welcome to Ubuntu Core 26

* Documentation: https://ubuntu.com/core/docs

This is a pre-built Ubuntu Core image. Pre-built images are ideal for
exploration as you develop your own custom Ubuntu Core image.

To learn how to create your custom Ubuntu Core image, see our guide:

* Getting Started: https://ubuntu.com/core/docs/get-started

In this image, why not create an IoT web-kiosk. First, connect a
screen, then run:

   snap install ubuntu-frame wpe-webkit-mir-kiosk
   snap set wpe-webkit-mir-kiosk url=https://ubuntu.com/core

For more ideas, visit:

* First steps: https://ubuntu.com/core/docs/first-steps
peterwhite23@localhost:~$

How I did it:

  1. download core-26-amd64 (somewhat buried in the docs — Tutorials → Try pre-built images → Use the dd command → Supported platforms)
  2. extracted the raw image from the XZ archive
  3. spin up new VM (used virt-manager but I bet VirtualBox can do the same)
    3.a import the extracted raw image instead of creating new storage
    3.b select customize before installing to then change the Firmware to UEFI+secureboot; don’t forget to add/enable TPM 2.0 device
  4. boot VM (complained briefly that no ubuntu-boot could be found but succeeded anyway)
    4.a use Ubuntu One email address for user registration
    [4.b ssh-keygen and subsequently upload public key to Ubuntu One]
    4.c ssh -i /where/private/key/is peterwhite23@<what ubuntu core says its IP is>
    [4.d sudo passwd $USER to enable local login]
  5. :smiling_face_with_sunglasses:
1 Like
5

Um, I’ve just realized that Ubuntu Core alone won’t give you TPM-backed FDE. Maybe just do the Clevis stuff then. Or, given that the Desktop has this all in a neat little package, why not start with “Desktop” installation on your server? Just install whatever server software you like after the obligatory installation and configuration of OpenSSH Server — don’t forget to disable GDM3 when going headless, otherwise the machine will auto-suspend after 15 minutes. Maybe install some sort of remote desktop solution to get access to the Desktop Security Center; there seems to be a little more to the story when it comes to setting passphrases and PIN’s or replacing the recovery key, because trying the passphrase with cryptsetup luksOpen --test-passphrase doesn’t work, yet the passphrase works at boot.

1 Like
6

Correction: it does, when a TPM 2.0 device is present; I had simply forgotten to add one to my VM. After fixing that oversight, nuking the already dirtied raw image and extracting a squeaky clean one from aforementioned XZ archive, it did enable encryption where desirable, i.e. the ubuntu-save and ubuntu-data partitions.

I’ve updated my previous comments accordingly.

2 Likes
7

Thanks for the update. good catch with out a tpm2.0 device Ubuntu Core wont enable TPM backed FDE. Your correction and VM setup notes will definitely help others avoid the same confusion.

1 Like
8

Buried indeed! Thank you for the links and for the instructions.

I can do this on a VM as you described, but how would I do this on bare metal? I suppose that I would have do use dd to copy the ISO to the drive, and then expand the partition as required? I’ve never done something like that.

I did look into doing that, but there were recommendations against it: It doesn’t install the full server; and it uses far more resources than just a server. I’m sure that I could have figured it out eventually.

I’m going to test that today! I’ll let you know how it goes.

(I already worked out and tested a method, which I’ll use if Clevis doesn’t work, but Clevis looks far simpler to set up.)

9

Results

I’m pleased to say that the Clevis system works. It’s somewhat simpler than the method that I worked out, but they use the same fundamental concepts, which is encouraging.

A security hole

Desktop 26.04 has protections against accessing the unlocked drive without a login.

But, with my method or with Clevis, there isn’t! You can simply go to Grub, choose Recovery Mode, and drop to root with full access to the unlocked drive.

This is a major security hole, and why I would have preferred the Desktop method to have been duplicated with the Server.

Preferred solution is unavailable

The preferred and recommended solution is to lock down Grub. Any Grub option is challenged by a username (specifically grubadmin) and a password. In order to allow unattended boot (e.g. after a power failure, or when rebooting after unattended updates), normal boot is excluded from the lockdown.

Grub allows this mechanism.

But, Canonical has explicitly prevented excluding normal boot from the lockdown. I can’t imagine why. There appears to be no practical way around this, unfortunately, so locking down Grub is ruled out.

Workaround

The only alternative solution that I was able to come up with is to create a root password.

This goes against the usual strong recommendation of disabling root login. Unfortunately, there’s no choice. You just have to have the discipline of never using the root password except for when you need to use the recovery option in Grub.

10

FWIW, you can easily use Ubuntu Core on servers, just install the LXD snap after initial setup and install whatever you need in an LXD container where you have full access to the hosts HW and can use apt like you are used to …

2 Likes
11

Thank you, Oliver. I’ve never used LXD, so that will take some learning for me. I haven’t even got Ubuntu Core working (yet).

12

The runes are quite simple:

$ sudo snap install lxd
$ sudo lxd init --auto
$ lxc launch ubuntu:24.04 noble
Creating noble
Starting noble
$ lxc shell noble ...

And you will be inside a root shell in the container called “noble” (you can indeed pick any other name with the lxc launch command) that you can exit with the “exit” command or Ctrl-D

(On UbuntuCore you also need sudo for the two commands I showed above without sudo or alternatively you can add the user manually to the lxd group by editing /var/lib/extrausers/group)

LXD has the big advantage to give you a full OS container (unlike docker that just wraps a single app execution), it behaves pretty exactly like a VM with all the features but without any of the overhead a VM has.

Oh, and it also comes with a built in management Web GUI:

2 Likes
13

I’ve got the disk onto a new virtual machine (steps 1, 2, 3).

I have booted the machine (steps 4, 4a).

But I’ve got stuck on uploading the key to Ubuntu One (step 4b), because the website https://login.ubuntu.com/ssh-keys is giving an error :frowning:

Oops
Oops911×320 68.1 KB

(And this forum is making it near-impossible to upload an image!)

14

TBH, I don’t really know. My intuition tells me that you’d have to dd the image to some top-level block device, i.e. /dev/sda, instead of a partition (sda1) and just fire up GParted (or GNOME Disks) and grow the partitions. But I don’t now know how much magic is already built into Ubuntu Core images; perhaps that’s something they do on first boot anyway they grow the partitions auto-magically on first boot — similar to the automatic TPM/FDE stuff?.

I think the additional resources are just what the desktop environment would use, if it were running. When I said to disable GDM3 I simply did not think of setting the default systemd target:

systemctl set-default multi-user.target

multi-user.target is everything but the graphical desktop stuff. That’s how one can switch to headless server mode in an easily accessible and well-defined way.
Some services, however, might have install directives pointing to default.target:

# /usr/lib/systemd/system/some.service
# [...]
[Install]
WantedBy=default.target

If such are installed (systemctl enable ..., e.g. by package install scripts) they will run even in multi-user.target, since it will be aliased to default.target — pipewire and friends, which are somewhat useless on a server, come to mind. So you may need to disable a few additional services (find them by running systemctl list-dependencies default.target), but, in general, I don’t see that one cannot make a desktop system into a trimmed down server. And if you need the desktop stuff (on demand), just run systemctl isolate graphical.target in an SSH session and login via remote desktop or locally, if you have a screen attached.

If you really want to trim the installed packages to the absolute minimum, I cannot recommend aptitude’s TUI highly enough. Start by minimizing the number of packages marked as manually installed: sudo apt-mark minimize-manual. Then I’d find ubuntu-desktop-minimal, mark it for removal (not actually committing the change just yet) and then wade through all its dependencies to manually install the ones I absolutely think necessary for a server with a GUI frontend, akin to Windows Server. Or, if I felt like it, I’d create my own ubuntu-server-gui metapackage, which only depends on the ones I’d have installed manually — here’s a real example of the workflow.

Perhaps also consider replacing NetworkManager with systemd-networkd; the latter being somewhat more befitting a server. Maybe the migration can be taken care of by simply installing ubuntu-server-minimal after marking NetworkManager as automatically installed. Be warned, though, that you could end up without SSH access if something goes wrong. I have never done it myself and don’t know what to look out for.

1 Like
15

The first half is correct, the second isn’t :wink:

The Ubuntu Core images are typically installed in factory processes where writing the image raw to the internal disk is a common task, the Core images are pre-partitioned and run an install mode on first boot that partitions the remaining free space of the disk…

… and since it does that, touching the existing partitions and resizing them to something not being in sync with the info inside the gadget snap (where the actual partitioning schema lives) would make the install step fail

3 Likes
16

This is Linux, and I have no doubt whatsoever that it’s possible — but not for someone like me. Although I meddle in the technical area, I am by no means a highly skilled meddler!

Thank you for the explanations and instructions, but they’re becoming too complicated for me :frowning:

That explains it well, Oliver, thank you. I’d like to test this on a VM. I’ll have to figure out how to do it. It might take a few days for me to get around to doing it.

EDIT: I’ve reported the bug with the Ubuntu One SSH-keys page:

https://bugs.launchpad.net/canonical-identity-provider/+bug/2158689

17

I’m not succeeding with Ubuntu Core.

I’ve run it in VirtualBox. Ubuntu One is working again, so I was able to add my public SSH key.

When I run the VM, it tells me how to ssh in, giving both IPv4 and IPv6 options.

ssh [username]@[IP address]

Whichever one I try, it times out.

I’m going to give up on Ubuntu Core at this point, because it’s taking up too much of my time.

18

I never used VirtualBox for this but there should be some networking option to allow port forwarding …

If you follow the documentation for KVM (which is what we use by default to test and run these images) you are told to simply use a specific port that gets forwarded like:

ssh -p 8022 user@localhost

I’d expect VBox to have some similar feature …

The doc I’m referring to is here:

https://documentation.ubuntu.com/core/how-to-guides/manage-ubuntu-core/test-on-qemu/

2 Likes
19

Thank you, Oliver. This is getting beyond my skill level. I understand the concept, but fiddling with the router and making this work is more than my practical level of knowledge.

I’ll stick with the devil I know!

20

It is just copy/paste, there are no skills needed … :slight_smile:

1 Like