this post was submitted on 23 Jun 2025
161 points (98.8% liked)

Linux

55572 readers
1597 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 6 years ago
MODERATORS
 

A while ago I made a tiny function in my ~/.zshrc to download a video from the link in my clipboard. I use this nearly every day to share videos with people without forcing them to watch it on whatever site I found it. What's a script/alias that you use a lot?

# Download clipboard to tmp with yt-dlp
tmpv() {
  cd /tmp/ && yt-dlp "$(wl-paste)"
}
top 50 comments
sorted by: hot top controversial new old
[–] Linsensuppe@feddit.org 9 points 2 hours ago (1 children)
[–] Revan343@lemmy.ca 1 points 27 minutes ago

alias sl='ls | while IFS= read -r line; do while IFS= read -r -n1 char; do if [[ -z "$char" ]]; then printf "\n"; else printf "%s" "$char"; sleep 0.05; fi; done <<< "$line"; done'

I can't easily check if it works until I get home to my laptop, but you get the idea

[–] IronKrill@lemmy.ca 1 points 55 minutes ago

on most of my systems I get tired of constantly lsing after a cd so I combine them:

cd(){
    cd $1 && ls
}

(excuse if this doesn't work, I am writing this from memory)

I also wrote a function to access docker commands quicker on my Truenas system. If passed nothing, it enters the docker jailmaker system, else it passes the command to docker running inside the system.

docker () {
        if [[ "$1" == "" ]]; then
                jlmkr shell docker
                return
        else
                sudo systemd-run --pipe --machine docker docker "$@"
                return
        fi
}

I have a few similar shortcuts for programs inside jailmaker and long directories that I got sick of typing out.

[–] phantomwise@lemmy.ml 1 points 1 hour ago

alias nmtui="NEWT_COLORS='root=black,black;window=black,black;border=white,black;listbox=white,black;label=blue,black;checkbox=red,black;title=green,black;button=white,red;actsellistbox=white,red;actlistbox=white,gray;compactbutton=white,gray;actcheckbox=white,blue;entry=lightgray,black;textbox=blue,black' nmtui"

It's nmtui but pretty!

[–] t0mri@lemmy.ml 1 points 1 hour ago

well i have a script. ive named it "shazam". it either creates or attachs to a tmux session named after the base name of the dir (first arg or current working directory). i also have "fzf-shazam" as the same suggests itll open a fzf finder to choose a dir to "shazam"

[–] twice_hatch@midwest.social 1 points 1 hour ago

alias scr=screen -dRU

I don't know why Screen has any other flags. I do not want to bother learning the keyboard shortcuts for tmux even though its probably works better

[–] MTK@lemmy.world 1 points 1 hour ago

None, I like to type

[–] Flyswat@lemmy.dbzer0.com 1 points 2 hours ago

To save videos from certain streaming sites that are not supported by yt-dlp, I catch the M3U playlist used by the page and with that I use this script that gets ffmpeg to put together the pieces into a single file.

#!/bin/bash
if [ "$1" == "-h" ] || [ $# -lt 2 ]; then
	echo Download a video from a playlist into a single file
	echo usage: $(basename $0) PLAYLIST OUTPUT_VID
	exit
fi

nbparts=$(grep ^[^#] $1 | wc -l)

echo -e "\e[38;5;202m Downloading" $(( nbparts - 1 )) "parts \e[00m"
time ffmpeg -hide_banner -allowed_extensions ALL -protocol_whitelist file,http,https,tcp,tls,crypto -i $1 -codec copy $2
[–] ter_maxima@jlai.lu 3 points 4 hours ago (1 children)

alias ed=$EDITOR

Extremely convenient on a qwerty keyboard.

This should probably be a default nowadays. Does even a single person here use the real ed ?

[–] misterbzr@lemm.ee 1 points 19 seconds ago

Me. Along with vi depending on my mood.

[–] ter_maxima@jlai.lu 1 points 4 hours ago* (last edited 4 hours ago)

ganis :

git add -A && sudo nixos-rebuild switch --impure -j$(nproc)

Everyone who uses nixos probably has a similar alias set x)

[–] DrunkAnRoot@sh.itjust.works 3 points 6 hours ago

i use

alias kimg='kitty +kitten icat' 

to display images in my terminal pretty simple but nice

[–] nimpnin@sopuli.xyz 4 points 7 hours ago

Since 720p downloading isn't really available on yt-dlp anymore, I made an alias for it

alias yt720p="yt-dlp -S vcodec:h264,fps,res:720,acodec:m4a"
[–] arcayne@lemmy.today 4 points 8 hours ago

Well, my full functions.sh won't fit in a comment, so here's 2 of my more unique functions that makes life a little easier when contributing to busy OSS projects:

# Git fork sync functions
# Assumes standard convention: origin = your fork, upstream = original repo
## Sync fork with upstream before starting work
gss() {
        # Safety checks
        if ! git rev-parse --git-dir >/dev/null 2>&1; then
                echo "❌ Not in a git repository"
                return 1
        fi

        # Check if we're in a git operation state
        local git_dir=$(git rev-parse --git-dir)
        if [[ -f "$git_dir/rebase-merge/interactive" ]] || [[ -d "$git_dir/rebase-apply" ]] || [[ -f "$git_dir/MERGE_HEAD" ]]; then
                echo "❌ Git operation in progress. Complete or abort current rebase/merge first:"
                echo "   git rebase --continue  (after resolving conflicts)"
                echo "   git rebase --abort     (to cancel rebase)"
                echo "   git merge --abort      (to cancel merge)"
                return 1
        fi

        # Check for uncommitted changes
        if ! git diff-index --quiet HEAD -- 2>/dev/null; then
                echo "❌ You have uncommitted changes. Commit or stash them first:"
                git status --porcelain
                echo ""
                echo "💡 Quick fix: git add . && git commit -m 'WIP' or git stash"
                return 1
        fi

        # Check for required remotes
        if ! git remote get-url upstream >/dev/null 2>&1; then
                echo "❌ No 'upstream' remote found. Add it first:"
                echo "   git remote add upstream <upstream-repo-url>"
                return 1
        fi

        if ! git remote get-url origin >/dev/null 2>&1; then
                echo "❌ No 'origin' remote found. Add it first:"
                echo "   git remote add origin <your-fork-url>"
                return 1
        fi

        local current_branch=$(git branch --show-current)

        # Ensure we have a main branch locally
        if ! git show-ref --verify --quiet refs/heads/main; then
                echo "❌ No local 'main' branch found. Create it first:"
                echo "   git checkout -b main upstream/main"
                return 1
        fi

        echo "🔄 Syncing fork with upstream..."
        echo "   Current branch: $current_branch"

        # Fetch with error handling
        if ! git fetch upstream; then
                echo "❌ Failed to fetch from upstream. Check network connection and remote URL."
                return 1
        fi

        echo "📌 Updating local main..."
        if ! git checkout main; then
                echo "❌ Failed to checkout main branch"
                return 1
        fi

        if ! git reset --hard upstream/main; then
                echo "❌ Failed to reset main to upstream/main"
                return 1
        fi

        echo "⬆️  Pushing updated main to fork..."
        if ! git push origin main; then
                echo "❌ Failed to push main to origin. Check push permissions."
                return 1
        fi

        echo "🔀 Rebasing feature branch on updated main..."
        if ! git checkout "$current_branch"; then
                echo "❌ Failed to checkout $current_branch"
                return 1
        fi

        if ! git rebase main; then
                echo "❌ Rebase failed due to conflicts. Resolve them and continue:"
                echo "   1. Edit conflicted files"
                echo "   2. git add <resolved-files>"
                echo "   3. git rebase --continue"
                echo "   Or: git rebase --abort to cancel"
                return 1
        fi

        echo "✅ Ready to work on branch: $current_branch"
}

## Sync fork and push feature branch
gsp() {
        # Safety checks
        if ! git rev-parse --git-dir >/dev/null 2>&1; then
                echo "❌ Not in a git repository"
                return 1
        fi

        local git_dir=$(git rev-parse --git-dir)
        if [[ -f "$git_dir/rebase-merge/interactive" ]] || [[ -d "$git_dir/rebase-apply" ]] || [[ -f "$git_dir/MERGE_HEAD" ]]; then
                echo "❌ Git operation in progress. Complete or abort first."
                return 1
        fi

        if ! git diff-index --quiet HEAD -- 2>/dev/null; then
                echo "❌ You have uncommitted changes. Commit or stash them first:"
                git status --porcelain
                return 1
        fi

        if ! git remote get-url upstream >/dev/null 2>&1; then
                echo "❌ No 'upstream' remote found"
                return 1
        fi

        if ! git remote get-url origin >/dev/null 2>&1; then
                echo "❌ No 'origin' remote found"
                return 1
        fi

        local current_branch=$(git branch --show-current)

        # Prevent pushing from main
        if [[ "$current_branch" == "main" ]]; then
                echo "❌ Cannot push from main branch. Switch to your feature branch first:"
                echo "   git checkout <your-feature-branch>"
                return 1
        fi

        # Show what we're about to do
        echo "⚠️  About to sync and push branch: $current_branch"
        echo "   This will:"
        echo "   • Fetch latest changes from upstream"
        echo "   • Rebase your branch on updated main"
        echo "   • Force-push to your fork (updates PR)"
        echo ""

        read -p "Continue? [y/N]: " -n 1 -r
        echo

        if [[ ! $REPLY =~ ^[Yy]$ ]]; then
                echo "❌ Operation cancelled"
                return 0
        fi

        echo "🔄 Final sync with upstream..."
        if ! git fetch upstream; then
                echo "❌ Failed to fetch from upstream"
                return 1
        fi

        echo "📌 Updating local main..."
        if ! git checkout main; then
                echo "❌ Failed to checkout main"
                return 1
        fi

        if ! git reset --hard upstream/main; then
                echo "❌ Failed to reset main"
                return 1
        fi

        if ! git push origin main; then
                echo "❌ Failed to push main to origin"
                return 1
        fi

        echo "🔀 Rebasing feature branch..."
        if ! git checkout "$current_branch"; then
                echo "❌ Failed to checkout $current_branch"
                return 1
        fi

        if ! git rebase main; then
                echo "❌ Rebase failed. Resolve conflicts and try again:"
                echo "   git add <resolved-files> && git rebase --continue"
                echo "   Then run 'gsp' again"
                return 1
        fi

        echo "🚀 Pushing feature branch to fork..."
        if ! git push origin "$current_branch" --force-with-lease; then
                echo "❌ Failed to push to origin. The branch may have been updated."
                echo "   Run 'git pull origin $current_branch' and try again"
                return 1
        fi

        echo "✅ Feature branch $current_branch successfully pushed to fork"
}
[–] jsomae@lemmy.ml 16 points 14 hours ago (3 children)

I wrote a script called please. You input please followed by any other command (e.g. please git clone, please wget blahblah) and a robotic voice will say "affirmative," then the command will run, and when it completes, the robotic voice reads out the exit code (e.g. "completed successfully" or "failed with status 1" etc.)

This is useful for when you have a command that takes a long time and you want to be alerted when it's finished. And it's a gentleman.

[–] notfromhere@lemmy.ml 9 points 11 hours ago* (last edited 11 hours ago) (1 children)
[–] jsomae@lemmy.ml 12 points 9 hours ago (1 children)

It's full of random shit I put in as a joke, but here it is. You can use please -s to get lightly roasted when your command fails.

spoiler

#!/bin/bash
# announces success or failure of task

if ! command -v "spd-say" > /dev/null
then
    echo "spd-say must be installed."
    exit -1
fi

VOLUME=0
SERIOUS=1
FINISH_ONLY=0

if [ $# -ge 2 ]
then
    if [ $1 == "-i" ]
    then
        # parse volume from command line
        VOLUME=$2
        shift 2
    fi
fi

spd-say -C

# force stop speech synthesizer
killall -q speech-dispatcher

# androgynous voice
# __sayfn="spd-say -i -80 -t female3"

# deep voice
__sayfn="spd-say -i $VOLUME -r -10 -p -100 -t male3"

function _sayfn {
    $__sayfn "$@" 2>/dev/null
    if [ $? -ne 0 ]
    then
        $__sayfn "$@"
    fi
}

if [ $# -eq 0 ] || [ "$1" == "--help" ]
then
    _sayfn "Directive required."
    echo "Usage: please [-i volume] [-s|--serious] [-f|--finish] <command...>"
    echo "       please [-i volume] --say text"
    echo "       -i: volume in range -100 to +100"
    echo "       --serious, -s: no silliness. Serious only. (Just kidding.)"
    echo "       --finish, -f: do not announce start"
    exit -2
fi

# threading issue
sleep 0.001

if [ $# -ge 2 ]
then
    if [ $1 == "--say" ]
    then
        # _sayfn the given line
        shift 1
        _sayfn "$@"
        exit 0
    fi

    if [ $1 == "--serious" ] || [ $1 == "-s" ]
    then
        shift 1
        SERIOUS=0
    fi
    
    if [ $1 == "--finish" ] || [ $1 == "-f" ]
    then
        shift 1
        FINISH_ONLY=1
    fi
fi

i=$(shuf -n1 -e "." "!") # inflection on voice

if [ "$FINISH_ONLY" -eq 0 ]
then
    if [ "$SERIOUS" -eq 0 ]
    then
        # startup lines (randomized for character)
        _sayfn -r -5 -x ".<break time=\"60ms\"/>$(shuf -n1 -e \
            'Proceeding As Directed...' \
            'By your command...' \
            'By your command...' \
            'By the power ov greyskaall!' \
            'By your command,line...' \
            'As you wish...' \
            'Stand by.' \
            'Engaged...' \
            'Initializing...' \
            'Activating' \
            'At once!' \
            "Post Haste$i" \
            'it shall be done immediately' \
            'Very well.' \
            'It shall be so.' \
            "righty-o$i" \
            "Affirmative$i" \
            "Acknowledged$i" \
            "Confirmed$i" \
        )"
    else
        _sayfn -r -5 -x ".<break time=\"60ms\"/>Engaged..."
    fi

    if [ $? -ne 0 ]
    then
        _sayfn "Speech engine failure."
        echo "Failed to run speech engine. Cancelling task."
        exit -3
    fi
fi

if ! command -v "$1" > /dev/null
then
    # _sayfn a little faster because this exits fast.
    _sayfn -r +10 "Unable to comply? invalid command."
    >&2 echo "$1: command not found."
    exit -4
fi

eval " $@"
result=$?
i=$(shuf -n1 -e "," "!" "?") # inflection on voice
transition=$(shuf -n1 -e "; error" ", with error" "; status")
taskname=$(shuf -n1 -e "task" "task" "command" "objective" "mission" "procedure" "routine")
errtext=$(shuf -n1 -e "Task_failed" "Task_failed" "Task_resulted_in_failure" "Procedure_terminated_in_an_error" "An_error_has_occurred" "Auxilliary_system_failure" "system_failure")
consolation=$(shuf -n1 -e "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "Attention required." "Attention is required!" "Perhaps It was inevitable." "It may or may not be cause for alarm." "Perhaps Machines too, are fallible." "Apologies" "Hopefully nobody else was watching" "shazbot" "maybe next time." "Nobody could have predicted this outcome." "I'm very sorry." "how unfortunate." "remember: don't panic" "oh dear" "Nothing could have been done to prevent this" "Remember: No disasters are fully preventable" "perhaps the only winning move is not to play" "Remember: Failure is our teacher, not our undertaker." "Remember: If at first you don't succeed... try again." "Remember: If at first you don't succeed... try... try again." "But your friends still love you." "Remember: the machine is not your enemy." "Command?" "Awaiting further instructions." "Remember: Logic is the beginning of wisdom... not the end of it." "Remember: When you eliminate the impossible, whatever remains, however improbable, must be the truth." "Keep at it. Victory is within reach." "Remember: The road to success and the road to failure are almost exactly the same." "Now, while this could have gone better, it could also have gone much worse." "Remember: we do this not because it is easy, but because we thought it was going to be easy." "Don't give up." "It has now been... -- zero... -- days, since the last serious failure." "Remember: instead of documenting the problem, you can fix it." "Remember: Artificial intelligence is no match for artificial stupidity." "Standing by," "Remember: with every failure, we get closer to success." "We live in a society." "sometimes failure is not an option; it's a necessity." "Keep at it." "Remember: mistakes are just the first step on the road to failure... <break time=\"250ms\"/> I mean success." "Don't leave. The drones need you... <break time=\"350ms\"/> They look up to you." "Try again, for great justice." "fantastic" "brilliant" "did you really think that would work?")

if [ $SERIOUS -eq 0 ]
then
    # perhaps some silliness.
    if [ $result -eq 0 ]
    then
        _sayfn --wait "$(shuf -n1 -e \
           "$taskname complete. All systems nominal" \
           "$taskname completed successfully." \
           "$taskname resulted in success." \
           "$taskname yielded a successful result." \
           "$taskname concluded successfully." \
           "$taskname completed as instructed." \
           "Jobs done." \
        )" &
    else
        if [ $result -eq 1 ]
        then
            _sayfn -x --wait "$(shuf -n1 -e \
               "Alert$i Primary system failure. Attention is required." \
               "Alert$i System failure$i Attention required! $consolation" \
               "Alert$i $taskname resulted in failure! <break time=\"150ms\"/> $consolation" \
               "Alert$i $taskname was not completed as intended; $consolation" \
               "Alert$i An error has occurred! <break time=\"220ms\"/> $consolation" \
            )" &
           
        else
            _sayfn --wait -x "Alert$i $errtext$transition code $result! <break time=\"350ms\"/> $consolation" &
        fi
    fi
else
    # no silliness here.
    if [ $result -eq 0 ]
    then
        _sayfn --wait "Command complete."
    else
        if [ $result -eq 1 ]
        then
            _sayfn -x --wait "Alert. Command failed; error code $result!"
        fi
    fi
fi

exit $result

[–] phantomwise@lemmy.ml 2 points 1 hour ago* (last edited 1 hour ago)

That's so neat

[–] Azzk1kr@feddit.nl 1 points 9 hours ago (1 children)

You can also use something like notifyd to generate a pop up for visual feedback :) I can't remember the exact command right now though. Differs per distro or desktop environment, obviously.

[–] SolarBoy@slrpnk.net 4 points 6 hours ago

notify-send 'command finished!' works pretty well

[–] data1701d@startrek.website 1 points 9 hours ago

I once experimented with something similar, except it was supported to trigger my smart speaker and drop into another part of the house to tell me.

Honestly, I really need to replace my proprietary smart speaker system with something self-hosted; it’s just I only recently have had the time to start cinsidering.

[–] jcs@lemmy.world 2 points 9 hours ago

I wrote this suite of scripts a few years ago and still use them to:

  1. Boot into Ventoy and select a Debian Live environment
  2. Optional: connect a storage device (local partition, USB drive, etc) for persistent storage
  3. Modify cfg/cfg.sh if it's the first time using the tool
  4. Run setup.sh to configure the environment into a familiar/productive state

The tools are flexible on hardware (more directed toward x64 systems at this time), and I (almost) never have to worry about OS upgrades. Just boot into a newer live OS image once it's ready. They are still a work-in-progress and still have a few customizations that I should abstract for more general use, but it's FOSS in case anyone has merge requests, issues, suggestions, etc.

[–] mavu@discuss.tchncs.de 8 points 13 hours ago (4 children)

alias fuck='sudo $(history -p \!\!)'

[–] savedbythezsh@sh.itjust.works 1 points 4 hours ago (1 children)

I have the same but it's called "please"

[–] mavu@discuss.tchncs.de 1 points 41 minutes ago

i touch computers since almost 40 years. "Please" stopped being an option somewhere in the early 2000's.

[–] Nibodhika@lemmy.world 3 points 6 hours ago (1 children)

Why not use thefuck which also corrects typos?

[–] mavu@discuss.tchncs.de 1 points 42 minutes ago

Because i'm not a psychopath, just autistic.

[–] Feathercrown@lemmy.world 5 points 9 hours ago (1 children)
[–] mavu@discuss.tchncs.de 1 points 43 minutes ago

Try it, and you will find it just does not provide the same emotional peace.

[–] Cyber@feddit.uk 3 points 9 hours ago
[–] irotsoma@lemmy.blahaj.zone 2 points 10 hours ago (1 children)

I alias traditional stuff to better, usually drop-in versions of that thing on computers that have the better thing. I often forget which systems have the better thing, so this helps me get the better experience if I was able to install it at some point. For example I alias cat to bat, or top to htop, or dig to drill, etc.

[–] ter_maxima@jlai.lu 1 points 4 hours ago

alias ed=$EDITOR is my most used alias by far.

[–] djblw@lemmy.world 4 points 12 hours ago

This tmux wrapper is remarkably convenient:

Usage:

# Usage: t [session-name]
#
# With no arguments:
#   Lists existing tmux sessions, or prints "[No sessions]" if none exist.
#
# With a session name:
#   Attempts to attach to the named tmux session.
#   If the session does not exist, creates a new session with that name.
#
# Examples:
#   t            # Lists all tmux sessions
#   t dev        # Attaches to "dev" session or creates it if it doesn't exist

function t {
	if [[ -z $1 ]]; then
		tmux ls 2> /dev/null || echo "[No sessions]"
	else
		tmux attach -t $@ 2> /dev/null
		if [[ $? -ne 0 ]]; then
			tmux new -s $@
		fi
	fi
}
[–] SuperiorOne@lemmy.ml 4 points 13 hours ago

jmpd(jump directory): fuzzy finds and opens directory with fzf

# fish shell
function jmpd
    set _selection $(fzf --walker=dir);
    if test -n "$_selection"
        cd "$_selection";
    end
end
[–] MangoCats@feddit.it 4 points 14 hours ago (1 children)

I have a collection of about 8 machines around the house (a lot of Raspberry Pi) that I ssh around to from various points.

I have setup scripts named: ssp1 ssp2 ssba ss2p etc. to ssh into the various machines, and of course shared public ssh keys among them to skip the password prompt. So, yes, once you are "in" one machine in my network, if you know this, you are "in" all of them, but... it's bloody convenient.

[–] randy@lemmy.ca 11 points 13 hours ago

I used to have scripts like that, but eventually switched to ssh aliases. You can set up an alias for each machine in ~/.ssh/config with lines like this:

Host p1
    HostName 192.168.1.123
    Port 22
    User pi

Then access with ssh p1. Slightly more typing, but avoids adding more commands to your $PATH. Also has the benefit of letting you use the same alias with other ssh-related commands like sftp.

[–] olafurp@lemmy.world 2 points 13 hours ago* (last edited 13 hours ago)

g-push

git push origin `git branch --show`
[–] kibiz0r@midwest.social 39 points 1 day ago* (last edited 22 hours ago) (2 children)

I often want to know the status code of a curl request, but I don't want that extra information to mess with the response body that it prints to stdout.

What to do?

Render an image instead, of course!

curlcat takes the same params as curl, but it uses iTerm2's imgcat tool to draw an "HTTP Cat" of the status code.

It even sends the image to stderr instead of stdout, so you can still pipe curlcat to jq or something.

#!/usr/bin/env zsh

stdoutfile=$( mktemp )
curl -sw "\n%{http_code}" $@ > $stdoutfile
exitcode=$?

if [[ $exitcode == 0 ]]; then
  statuscode=$( cat $stdoutfile | tail -1 )

  if [[ ! -f $HOME/.httpcat$statuscode ]]; then
    curl -so $HOME/.httpcat$statuscode https://http.cat/$statuscode
  fi

  imgcat $HOME/.httpcat$statuscode 1>&2
fi

cat $stdoutfile | ghead -n -1

exit $exitcode

Note: This is macOS-specific, as written, but as long as your terminal supports images, you should be able to adapt it just fine.

load more comments (2 replies)
[–] data1701d@startrek.website 3 points 15 hours ago (1 children)

I use Clevis to auto-unlock my encrypted root partition with my TPM; this means when my boot partition is updated (E.G a kernel update), I have to update the PCR register values in my TPM. I do it with my little script /usr/bin/update_pcr:

#!/bin/bash
clevis luks regen -d /dev/nvme1n1p3 -s 1 tpm2

I run it with sudo and this handles it for me. The only issue is I can't regenerate the binding immediately after the update; I have to reboot, manually enter my password to decrypt the drive, and then do it.

Now, if I were really fancy and could get it to correctly update the TPM binding immediately after the update, I would have something like an apt package shim with a hook that does it seamlessly. Honestly, I'm surprised that distributions haven't developed robust support for this; the technology is clearly available (I'm using it), but no one seems to have made a user-friendly way for the common user to have TPM encryption in the installer.

[–] notfromhere@lemmy.ml 1 points 11 hours ago (1 children)

Is clevis using an attestation server or is it all on a single machine? I’m interested in getting this set up but the noted lack of batteries included for this in the common distros makes it a somewhat tall order.

[–] data1701d@startrek.website 2 points 9 hours ago (1 children)

In my case, no; it’s all a single machine - it is in the initramfs and uses the system’s TPM to (relatively) securely store the keys.

It can be set up with an attestation server, but you certainly don’t have to do it. The Arch wiki has a really good article on getting it set up.

[–] notfromhere@lemmy.ml 1 points 9 hours ago (1 children)

How difficult is it for an adversary to get in the middle of the TPM releasing the keys to LUKS? That’s why I would want attestation of some sort, but that makes it more complicated and thinking about how that would work in practice makes my head spin…

[–] data1701d@startrek.website 2 points 9 hours ago

Vulnerabilities certainly do exist, but I’m pretty sure the attacker has to be well-equipped

I’d call it a protection against data getting cracked in a petty theft, but if your attack vector is much more than that, there are other measures you should probably take. I think Clevis also works with Yubikeys and similar, meaning the system won’t decrypt without it plugged in.

Heck, I think I know someone who just keeps their boot partition with the keys on it on a flash drive and hide it on their person.

load more comments
view more: next ›