4 ms·
Dracut works pretty well. I managed to get it to auth me with sshd using an ed25519 key stored on my yubikey. I then use gpg-agent in dracut to decrypt my key
by anon9001 7y ago
Dracut works pretty well. I managed to get it to auth me with sshd using an ed25519 key stored on my yubikey. I then use gpg-agent in dracut to decrypt my keyfile and use that to unlock the root partition, which then boots and kicks me out of ssh. It's a pretty clean answer for a fully encrypted home server.
Of course, it doesn't encrypt /boot, but I keep a separate USB stick for that and put it in the server when it needs a reboot.
- rdslw 7y agoCan you share (blog? github?) more details (ideally whole dracut module :) about your implementation?
- anon9001 7y agoI haven't posted it anywhere because it's a bit of a mess, but here you go: https://pastebin.com/ZfkM2zkU https://pastebin.com/ZfkM2zkU I'm not proud, or smart, but it works. Systemd is used for networking to make it simpler. I based it on this: https://github.com/gsauthof/dracut-sshd https://github.com/gsauthof/dracut-sshd I should probably package it up with all the config options you'd need to specify drive and keyfile location and all that, but I'm a terrible member of the community and haven't actually done it yet. The real trick that took me a long time to figure out was invoking "cryptsetup luksOpen" with my mount.sh script and then using "systemctl stop systemd-cryptsetup@nvme0n1p3_crypt.service" to get the thing to keep booting. I still don't really understand the tty ask password stuff in systemd, but this seems to work fine. You just ssh in and run ./mount.sh and it decrypts/mounts/boots.