Hey I hope you can help me out.
I’m using my laptop with OpenSUSE TW. The one SSD is luks2 encrypted and I set it up with a passphrase in the beginning. I recently got 2 Yubikeys and I want to use them to unlock my device on boot. I added both Yubikeys, the primary and backup, to all partitions /dev/sda2,/dev/sda3,/dev/sda4 all without pin input via
sudo systemd-cryptenroll --fido2-with-client-pin=no --fido2-device=auto /dev/sdaX
the keysslots are 0 passphrase, 1 FIDO2 (backup), 2 FIDO2 (primary)
I added
cr_swap UUID=<UUID> - fido2-device=auto
cr_home UUID=<UUID> - fido2-device=auto
cr_root UUID=<UUID> - x-initrd.attach,fido2-device=auto
to /etc/crypttab. furthermore ran sudo dracut -f
now after a reboot I still have to type in my passphrase and get prompted to touch my token after that.
Does the order of slots matter for that? I hope you all can help me out!