Decrypting LUKS from initramfs; was: Re: ext2 for /boot ???
Hello,
On Sat, Sep 15, 2018 at 11:52:01PM +0200, deloptes wrote:
> I also wish I knew how to get ssh into initrd and the whole networking, so
> that I could do it remotely when needed.
I've never done it myself, as I have IPMI access to anything I care
about, but it appears to be as simple as installing and configuring
the dropbear-initramfs package. This guide is for Ubuntu but looks
like it would translate to Debian well:
https://hamy.io/post/0009/how-to-install-luks-encrypted-ubuntu-18.04.x-server-and-enable-remote-unlocking/
Also:
https://wiki.debian.org/RescueInitramfs
I've also heard of people who use key/value stores or software
password safes or whatever to request the passphrase at boot time in
order to do completely automated boots.
The obvious problem there is an attacker who gets hold of the
initramfs in order to be able to use the credentials to request the
passphrase themselves. For those who wanted to get more elaborate
(and more likely to mess up and leave their server a useless
encrypted brick), there are things like Mandos:
https://wiki.recompile.se/wiki/Mandos
https://www.recompile.se/mandos/man/intro.8mandos
"This is the the Mandos system, which allows computers to have
encrypted root file systems and at the same time be capable of
remote and/or unattended reboots.
The computers run a small client program in the initial RAM disk
environment which will communicate with a server over a network.
All network communication is encrypted using TLS. The clients
are identified by the server using an OpenPGP key; each client
has one unique to it. The server sends the clients an encrypted
password. The encrypted password is decrypted by the clients
using the same OpenPGP key, and the password is then used to
unlock the root file system, whereupon the computers can
continue booting normally."
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
Please consider the environment before reading this e-mail.
— John Levine
Reply to: