Re: OPAL setup for a new drive without sedutil initial setup

[Nikolai Grigoriev <nikolai@grigr.xyz>]

I tried to enter a password expecting it to become my new Admin1 password. That did not work. The message was something like "Invalid Admin1 password or permission denied". I ran it with "--hw-opal-only" against /dev/nvme0n1p3. The drive us brand-new Crucial T500 2Tb. Never used sedutil on it. I will try sedutil now to see what is going on and to set my password.

--
Nikolai Grigoriev



Mar 18, 2024, 04:36 by okozina@redhat.com:

> On 18/03/2024 03:21, Nikolai Grigoriev wrote:
>
>> Hello,
>>
>> I was about to set up a new machine and I was about to use OPAL the "old" way. And then I discovered that cryptsetup now supports OPAL! Thanks :)
>>
>> However, something is not clear to me from the documentation. When I tried "luksFormat", I was prompted for both passphrase and OPAL Admin password.  For the former it is clear, this is the passphrase for LUKS2 itself. However, I never configured OPAL on this drive, thus, it does not have an Admin1  password (and SID) set at all.
>>
>> Does it mean I still need to  use "sedutil-cli  --initialsetup" before using cryptsetup or...or I do not understand what  is expected :) The documentation seems to suggest that this password needs to be provided only when initial setup was  done. Should I enter an empty one then? And if so, what my actual Admin1 password will be after setup is complete?
>>
>
> Cryptsetup does the initial setup automatically provided the device report itself as yet uninitialized.
>
> IOW, it should work on SED OPAL devices in both states. Either, you have to provide existing Admin1 PIN or you are setting a new one during luksFormat command.
>
> Kind regards
> Ondrej
>