3 ms·
You could add shamir secret sharing and restrict your remote access to running a program that accepts your secret.
by Canada 9y ago
You could add shamir secret sharing and restrict your remote access to running a program that accepts your secret.
- mirimir 9y agoSure. I don't know how to integrate that with LUKS, however. But even so, once I had remote SSH access to initramfs, and had unlocked LUKS, I could mount /root and mess with the system, adding my own trusted key for remote access, etc. So basically, users would need to trust me fully.
- Canada 9y agoYour special login shell would not allow you to do anything except provide your secret, after which you are simply disconnected without having the opportunity to do anything else. A different process not under your control would mount the volume. At no point would you get to execute arbitrary commands or open any files. You would only have to be trusted not to hold your secret for ransom.