How to Configure LUKS Network-Bound Disk Encryption in Ubuntu Using Clevis and Tang

Deploying full-disk encryption with Linux Unified Key Setup (LUKS) on headless servers, virtualised infrastructure, or remote edge gateways presents a major operational dilemma: requiring an administrator to manually enter a passphrase upon every system reboot creates severe downtime and prevents unattended recoveries. Storing plain-text keys on local storage, conversely, defeats the security of data-at-rest encryption. Network-Bound Disk Encryption (NBDE) solves this challenge by decoupling encryption keys across an internal network. Using the Tang server daemon and the Clevis client framework, Ubuntu servers can automatically decrypt LUKS root and data partitions at boot time as long as they reside on a trusted corporate or datacentre network.

Understanding Network-Bound Disk Encryption (NBDE) Architecture

NBDE relies on secure cryptographic threshold binding without requiring complex Public Key Infrastructure (PKI) or hardware TPM modules:

• Tang Server: A lightweight network cryptographic service that advertises asymmetric signing and key-exchange keys via HTTP. Crucially, Tang never stores client encryption keys or passphrases; it merely facilitates blind Shamir Secret Sharing (SSS) key exchanges via the McCallum-Relyea protocol.
• Clevis Framework: A client-side pluggable framework that binds cryptographic secrets to environmental policies (pins). The clevis-luks pin binds a LUKS keyslot to a Tang server, generating an ephemeral decryption key during boot.
• Dracut / Initramfs Integration: During early boot, the initramfs network stack activates, queries the Tang server, reconstructs the secret, unlocks the LUKS volume, and passes execution to the root filesystem. If the physical server is stolen and booted outside the secure local subnet, Tang is unreachable, and the system prompts for the manual recovery passphrase.

Setting Up the Tang Server on Ubuntu

The Tang server should run on a separate, high-availability host within your trusted internal management network. Install the server package:

sudo apt update && sudo apt install -y tang

Tang runs on TCP port 8888 by default using systemd socket activation. Verify that the socket is active:

sudo systemctl enable --now tangd.socket
systemctl status tangd.socket

Retrieve the Tang server’s public key fingerprint (advertised via the Tang signing key). Note this hash for client-side pinning:

curl -s http://192.168.1.50:8888/adv | tang-show-keys

Installing Clevis Client Packages on the Encrypted Host

On the client machine that contains the encrypted LUKS partition (such as /dev/nvme0n1p3 or /dev/sda3), install the Clevis utilities and initramfs hooks:

sudo apt update && sudo apt install -y clevis clevis-luks clevis-initramfs clevis-systemd

Binding a LUKS Volume to the Tang Server

Before binding, ensure you know an existing valid passphrase for the target LUKS volume. Bind the volume to the Tang endpoint using clevis luks bind:

sudo clevis luks bind -d /dev/nvme0n1p3 tang '{"url":"http://192.168.1.50:8888","thp":"<Tang-Key-Thumbprint>"}'

The command prompts for an existing LUKS passphrase to authenticate the key slot addition. Once authenticated, Clevis populates an available LUKS key slot with a cryptographically bound token.

Verify that the new keyslot is populated:

sudo cryptsetup luksDump /dev/nvme0n1p3

To inspect the Clevis pin configuration bound to the block device:

sudo clevis luks list -d /dev/nvme0n1p3

Configuring Early-Boot Networking in Initramfs

Because the root filesystem requires network access to query the Tang server before mounting /, configure static IP or DHCP network parameters inside the client initramfs:

sudo nano /etc/initramfs-tools/initramfs.conf

Ensure the DEVICE parameter specifies your primary network interface, or define a static kernel IP argument:

# For dynamic DHCP early boot
DEVICE=eth0

# Alternatively, for static IP configuration (IP::Gateway:Netmask:Hostname:Interface:none)
# IP=192.168.1.60::192.168.1.1:255.255.255.0:ubuntu-server:eth0:none

Rebuild the initramfs ramdisk image to embed the Clevis decryption hooks and network drivers:

sudo update-initramfs -u -k all

Testing and Validating Unattended Decryption

Reboot the client server while attached to the local management network:

sudo reboot

Monitor the system console. During early boot, the kernel initializes eth0, issues an HTTP query to Tang on port 8888, decodes the Shamir secret share, and unlocks the root partition seamlessly without halting for keyboard input.

Revoking Tang Bindings and Managing Key Slots

If decommissioning the Tang server or untethering the machine for relocation, unbind the Clevis slot:

# Identify the slot index
sudo clevis luks list -d /dev/nvme0n1p3

# Unbind Clevis from slot (e.g., slot 1)
sudo clevis luks unbind -d /dev/nvme0n1p3 -s 1

Deploying Clevis and Tang provides enterprise Ubuntu deployments with robust data-at-rest protection while maintaining full operational continuity for unattended reboots and scheduled kernel updates.