This is a script I came across for setting up a remote-unlockable FreeBSD system with Full Disk Encryption that can be unlocked over SSH. FDE in so far as the

This is a script I came across for setting up a remote-unlockable FreeBSD system with Full Disk Encryption that can be unlocked over SSH. FDE in so far as the "inner system" is concerned, one should say. The "outer system" with the initial ssh daemon is not encrypted, as it needs to be able to boot without user input. Their readme explains the problem it solves, and how it works: > the problem > If a server resides on encrypted media, it's difficult to unlock it remotely after a reboot. When a fully encrypted system boots, it usually sits and waits for a passphrase to be entered long before the network is ready to allow a remote connection. > Common solutions include virtualization, the serial console (traditional or through a DIY server), IPMI and friends, or IP-KVM hardware (expensive traditional or low-cost DIY). > outer base solution > This solution builds upon two previous implementations of the following idea: an unencrypted barebones system (the outer base) boots and accepts incoming SSH connections. Over SSH, the encrypted system can be unlocked. Then, FreeBSD's reboot -r command is used to reboot (more precisely: re-root the kernel) into the unlocked system (the inner base)