I'm buying servers lately and all of them have disks that support TCG Opal full-disk encryption (aka SED). What I'd like to do is:

  • Store data encrypted-at-rest on the disks (NVMe & SAS).
  • Not be required to enter a password/passphrase at server boot.
  • Have encryption keys be stored in the server's TPM 2.0 module.

To simplify, the goal is to "lock" the data to the server, ensuring that if a disk is removed and inserted in another machine the data is inaccessible. I've seen sedutil but haven't yet played with it as it looks like it requires entering a passphrase at every boot. I have hundreds of servers I'd like to enable this on, so having to enter a passphrase (is it per-disk?) at reboot is not an option. TPM seems like a natural place to store this kind of thing, so I'm wondering if anyone's done anything like this. The only reference I can find to anything like this is in this Micron white paper. The servers are all running Ubuntu 16.04 (Xenial). There's more than one disk per server, if that matters.

  • Did you ever find a solution for this? I find myself in a similar situation now. – Dominic P Jan 11 at 18:05
  • Unfortunately, no. Ended up using LUKS at the filesystem level and just eating the performance hit. – Evan Feb 28 at 15:35
  • Thanks for the confirmation. I appreciate it. SED seems like such a great idea in theory, but the practical tools for interacting with it leave a lot to be desired in my opinion. – Dominic P Feb 28 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.