3 ms·
Full Disk Encryption is an option, but that’ll entail needing the use the IPMI console to enter the password at every reboot, essentially turning it into a manu
by woadwarrior01 7y ago
Full Disk Encryption is an option, but that’ll entail needing the use the IPMI console to enter the password at every reboot, essentially turning it into a manual operation.
- kadoban 7y agoIf you have physical access twice, full disk encryption usually doesn't help really at all. IPMI seems about as powerful as physical access.
- FDSGSG 7y agoIf you just ignore random reboots, sure. But why would you?
- kadoban 7y agoI don't think that'd be necessary, couldn't you make changes and then wait for natural reboots?
- FDSGSG 7y agoYou couldn't, not via console access anyway. However, if the attacker gains RCE many IPMI implementations theoretically allow for DMA, but this is a significantly more complex attack to mount in practice with no public PoCs available.
- mirimir 7y agoOne can do LUKS with access via dropbear in initramfs. If you're lucky during network install, you'll never need out of bound access. But rebooting is still a manual process.