4 ms·

Can it enter the password required to decrypt my LUKS partition? Lately this has been my biggest barrier to leaving a computer fully remote.

by Too 5y ago

razemio 5y ago
You could use a Mainboard with an IPMI module and KVM-over-LAN functionality. This way your are able to do everything remote, including mounting isos to install a new system and ofc you could use it to enter your password for the encrypted partition.
escalt 5y ago
You can embed a minimal ssh server (like dropbear or tinyssh) in your initramfs to remotely enter the passphrase. There are some guides for that online
- justin_oaks 5y ago
  Yes, this works. I have it set up for some servers that have encrypted hard drives.
londons_explore 5y ago
Store the LUKS crypto key in the TPM, and make sure secure boot is used so the TPM will only reveal the key if the systems boot chain is verified.
- mschuster91 5y ago
  Nope. That's dangerous, TPM keys can be sniffed on the bus: https://trmm.net/tpm-sniffing/ https://trmm.net/tpm-sniffing/
  - brirec 5y ago
    Is a LUKS key being sent remotely to Intel ME _not_ vulnerable to being sniffed on the LAN?
    - mschuster91 5y ago
      You don't need to involve ME into remote decrypting. Embed the LUKS binaries and dropbear into your initramfs, and off you go.
adarshaj 5y ago
look into tang and clevis.
mschuster91 5y ago
I have followed this guide: https://blog.buettner.xyz/luks-verschlusseltes-ubuntu-20-04-remote-ssh-entschlusseln/ https://blog.buettner.xyz/luks-verschlusseltes-ubuntu-20-04-...
exikyut 5y ago
If you can fiddle around and get the VNC functionality working, then as long as you have it behind a bastion host you basically have insta-BMC. I kneejerk-recommend a bastion host because a) Intel ME, and b) there was that all-0 password bypass a while back and uhhh yeah who knows what other "sneeze correctly and the leaf falls over" knock sequences there are. SSH port forwarding, VPN, RPi running the remote-access AMT web UI thingy (runs on Linux, forget what it's called) behind nginx with authentication... you get the idea.

Can it enter the password required to decrypt my LUKS partition? Lately this has been my biggest barrier to leaving a computer fully remote.

by Too 5y ago

Can it enter the password required to decrypt my LUKS partition? Lately this has been my biggest barrier to leaving a computer fully remote.

razemio 5y ago

You could use a Mainboard with an IPMI module and KVM-over-LAN functionality. This way your are able to do everything remote, including mounting isos to install a new system and ofc you could use it to enter your password for the encrypted partition.

escalt 5y ago

You can embed a minimal ssh server (like dropbear or tinyssh) in your initramfs to remotely enter the passphrase. There are some guides for that online

justin_oaks 5y ago
Yes, this works. I have it set up for some servers that have encrypted hard drives.

londons_explore 5y ago

Store the LUKS crypto key in the TPM, and make sure secure boot is used so the TPM will only reveal the key if the systems boot chain is verified.

mschuster91 5y ago
Nope. That's dangerous, TPM keys can be sniffed on the bus: https://trmm.net/tpm-sniffing/ https://trmm.net/tpm-sniffing/
- brirec 5y ago
  Is a LUKS key being sent remotely to Intel ME _not_ vulnerable to being sniffed on the LAN?
  - mschuster91 5y ago
    You don't need to involve ME into remote decrypting. Embed the LUKS binaries and dropbear into your initramfs, and off you go.

adarshaj 5y ago

look into tang and clevis.

mschuster91 5y ago

I have followed this guide: https://blog.buettner.xyz/luks-verschlusseltes-ubuntu-20-04-remote-ssh-entschlusseln/ https://blog.buettner.xyz/luks-verschlusseltes-ubuntu-20-04-...

exikyut 5y ago

If you can fiddle around and get the VNC functionality working, then as long as you have it behind a bastion host you basically have insta-BMC. I kneejerk-recommend a bastion host because a) Intel ME, and b) there was that all-0 password bypass a while back and uhhh yeah who knows what other "sneeze correctly and the leaf falls over" knock sequences there are. SSH port forwarding, VPN, RPi running the remote-access AMT web UI thingy (runs on Linux, forget what it's called) behind nginx with authentication... you get the idea.