Re: OPAL setup for a new drive without sedutil initial setup

[Ondrej Kozina <okozina@redhat.com>]

On 18/03/2024 03:21, Nikolai Grigoriev wrote:
> Hello,
> 
> I was about to set up a new machine and I was about to use OPAL the "old" way. And then I discovered that cryptsetup now supports OPAL! Thanks :)
> 
> However, something is not clear to me from the documentation. When I tried "luksFormat", I was prompted for both passphrase and OPAL Admin password.  For the former it is clear, this is the passphrase for LUKS2 itself. However, I never configured OPAL on this drive, thus, it does not have an Admin1  password (and SID) set at all.
> 
> Does it mean I still need to  use "sedutil-cli  --initialsetup" before using cryptsetup or...or I do not understand what  is expected :) The documentation seems to suggest that this password needs to be provided only when initial setup was  done. Should I enter an empty one then? And if so, what my actual Admin1 password will be after setup is complete?

Cryptsetup does the initial setup automatically provided the device 
report itself as yet uninitialized.

IOW, it should work on SED OPAL devices in both states. Either, you have 
to provide existing Admin1 PIN or you are setting a new one during 
luksFormat command.

Kind regards
Ondrej