Linux: Configure and use your TPM module on Linux

In this article we’ll see how to configure and use a TPM 1.2 module (Trusted Platform Module)  on CentOS 7 (RHEL 7, PacketLinux 2 and Scientific Linux and Fedora) and Debian, Kali and Ubuntu Linux.

Disclaimer

Before reading this article make sure you have read and understood my article about the TPM module per se (click here to read it). The article here below explains how to install and configure TPM 1.2 on a Linux system.

Intro

A TPM module (or Trusted Platform Module) is an international standard for a secure cryptoprocessor, which is a dedicated microcontroller designed to secure hardware by integrating cryptographic keys into devices. ( you can find more info about what it is and how it works at this link: here ).

If you have a TPM 2.0 please read my article about configuring TPM 2.0 instead, link here.

Let’s configure TPM 1.2 on Linux

To use it on RHEL 7 (CentOS 7, PacketLinux 2, Scientific Linux and Fedora) or Debian 9 or up and OpenSuse, first of all you need to configure your PC BIOS to enable it. This procedure will depend on the BIOS you have, the motherboard you have and the also the release of your TPM module, so for this step please check your motherboard manual.

Please Note: If you install a TPM module and leave it disabled as TPM (but you have enabled your BIOS Security CHIP flag) then you most likely will get the following error when Linux Kernel will boot up: “a tpm error (7) occurred attempting to read a pcr value”. To fix this please enable your TPM module in your BIOS.

When you have completed the full activation process on your BIOS, boot up your Linux system and login as root on your console (if you can’t login as root then remember to use sudo before each commands below!).

first of all verify that your kernel can see the TPM module correctly by checking your /var/log/message like this:

# cat /var/log/messages | grep -i tpm

It should display your tpm module release, something similar to the following string:

Mar 17 20:37:15 vmm kernel: tpm_tis 00:05: 1.2 TPM (device-id 0xD, rev-id 18)

If nothing is displayed please try also:

# dmesg | grep -i tpm

Then check if the tcsd daemon is up and running:

# systemctl status tcsd

If you can’t find tcsd you can install it via:

On CentOS, Fedora, PacketLinux, RHEL and ScientificLinux

# yum -y install trousers

On Debian, Kali and Ubuntu

# apt install trousers

On OpenSuse

# zypper install trousers -y

If tcsd is not running then you can run it via:

# systemctl start tcsd

If tcsd is not running then you may get an error like this one when you’ll try to access/connect to your tpm module: “Tspi_Context_Connect failed: 0x00003011 – layer=tsp, code=0011 (17), Communication failure”. To avoid this problem you must start tcsd.

If it starts correctly then you can make sure it will start at every system reboot via:

# systemctl enable tcsd

At this point you can install all your tpm tools via:

On CentOS, Fedora, PacketLinux, RHEL and ScientificLinux

# yum -y install tpm-tools

On Debian, Kali and Ubuntu

# apt install tpm-tools -y

On OpenSuse

# zypper install tpm-tools -y

And finally query directly your TPM module with:

# tpm_version

If everything is ok you should see an output similar to the following one:

 TPM 1.2 Version Info:
 Chip Version: 1.2.3.19
 Spec Level: 2
 Errata Revision: 2
 TPM Vendor ID: XYZ
 Vendor Specific data: xxxxxxxx yy
 TPM Version: zzzzzzzz
 Manufacturer Info: hhhhhhhh

You are now ready to get ownership of your TPM module and start the fun 🙂

In future articles we’ll see how we can use it and also how we can program it…

What next?

• Read what is a TPM module (for all platforms included mac and Raspberry Pi) here.
• Read about what you can do with a TPM either as a software developer or as a system administrator here.
• Read how to configure Linux to use your TPM 2.0 and how to check if your system has got one here.

Ok that’s it for now, thanks for reading and I hope you’ve found some useful information here. If you enjoyed this post, please don’t forget to support my blog by:

• Visiting my on-line hacking and engineering merchandise shop on redbubble.com by clicking here
• Or you can also make a donation with the PayPal link in the column on your right
• Or share this article

If you like my articles and want to keep getting informed on new ones you can follow me on on of those 21st Century thingies called Facebook, Twitter, Instagram or Pinterest

And as always if you have any questions please feel free to use the comments section below.

Thank you!