4 ms·
I thought that everyone has switched to Clevis + Tang for that? https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardenin
by babuskov 3y ago
I thought that everyone has switched to Clevis + Tang for that?
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening https://access.redhat.com/documentation/en-us/red_hat_enterp...
It's fully automated and supposed to be much more secure.
Has anyone got experience with it?
- traceroute66 3y ago> I thought that everyone has switched to Clevis + Tang for that? Clevis+Tang is good. There's also Keylime which takes a different approach to the same[1]. [1] https://keylime.dev/ https://keylime.dev/
- soraminazuki 3y agoIIUC whether that is secure depends on your threat model. For example, how good is automated unlocking compared to unencrypted drives in a homelab setup?
- ahepp 3y agoI've seen a bit about Clevis. Is there a major difference between using this, and systemd-cryptenroll?
- babuskov 3y agoI guess it depends on your use case. If you rent a bunch of bare-metal servers at a remote location and you want restarts after updates to be fully automated, Clevis seems like a way to do. The whole idea is that once you cancel the server, you just remove it from Tang's list and the next customer who gets those hard drives cannot read them. AFAICT, systemd-cryptenroll requires that you have a USB key plugged into the machine, so someone with physical access would have to insert them at the start and remove when you're done with the server. With Clevis+Tang everything is software. Or am I missing something?
- ahepp 3y agoThat makes sense. I was thinking about the case of using a TPM to unlock full disk encryption as long as secure boot hashes checked out.