4 ms·

Every time I hook my dev NUC up to my HDMI cable and plug in a keyboard, just to decrypt the ssd en get back to working after a reboot, I will now be thinking o

Every time I hook my dev NUC up to my HDMI cable and plug in a keyboard, just to decrypt the ssd en get back to working after a reboot, I will now be thinking of this story and feel better about this little nuisance. (Yeah I know there are better ways, I could ssh into the boot env with systemd, I could just encrypt the home dir, I could somehow use the TPM (but that is still pita) etc, I'll look at that the next time I set up the a dev machine...)

inductive_magic 2y ago
YubiKey
- microtonal 2y ago
  Or remote unlock: https://github.com/gsauthof/dracut-sshd https://github.com/gsauthof/dracut-sshd
  - inductive_magic 2y ago
    Very cool, ty.
adriancr 2y ago
You can use "keyscript=" in "/etc/crypttab" to run any script you want. Using that you could set up networking and download the key from somewhere (say a remote KMS that would need user approval before continuing). So you would reduce your problem to being prompted on phone to unlock your desktop. You could even use some sort of hardware key to prove request came from the physical server. (simplest might be a RP2350 with some key burnt in) Or you could use something like SGX if it's still available anywhere to prove the same.
- michaelt 2y ago
  > You can use "keyscript=" in "/etc/crypttab" to run any script you want. ...unless your distro uses systemd, which removes keyscript support [1] because the systemd guy "really dislikes generic callouts" [1] https://github.com/systemd/systemd/pull/3007 https://github.com/systemd/systemd/pull/3007
  - sterlind 2y ago
    you can apparently provide a Unix socket path in /etc/crypttab now, and it will connect and read the key from the socket. so you can have the same functionality, but you have to get at it a different way: https://github.com/systemd/systemd/pull/17524 https://github.com/systemd/systemd/pull/17524
  - adriancr 2y ago
    It's 2024 and keyscript still works fine on ubuntu
    - aflukasz 2y ago
      I don't use this param at the moment anywhere to confirm experimentally, but I'm pretty sure it's same on Debian: https://salsa.debian.org/cryptsetup-team/cryptsetup/-/blob/70ec02716f451a0272e7b1fa46c081cb94f1e910/debian/functions#L274 https://salsa.debian.org/cryptsetup-team/cryptsetup/-/blob/7....
  - pacificenigma 2y ago
    For years I've used https://github.com/anatol/booster https://github.com/anatol/booster to unlock LUKS partitions using network bound disk encryption with https://github.com/latchset/clevis https://github.com/latchset/clevis and https://github.com/latchset/tang https://github.com/latchset/tang. Works well, especially as Tang is stateless (so deployment and high availability is easy) and Booster falls back to password entry if Tang is unavailable.
    - aflukasz 2y ago
      Thumbs up for clevis/tang, happy user here, too! Did not hear about booster. Its README claims "Clevis style data binding. The encrypted filesystem can be bound to TPM2 chip or to a network service.". Does it mean that it tries to deliver various bindings independently from clevis pins, even when duplicating their functions?
  - adsf325q3 2y ago
    [flagged]
iam-TJ 2y ago
If you are physically present but the device is operating headless, and if using LUKS and GRUB, you can use a hardware token such as YubiKey via USB to unlock the device without needing to see the console. I do this with a gateway/router on a PC Engines APU2 that has an internal SSD. Just ensure GRUB includes the requisite USB modules in its core image, or use grub-mkstandalone to include all modules in core.
- tmikaeld 2y ago
  Please don't do this unless you have a backup yubikey with the same key on it..
  - teekert 2y ago
    Or all state-full data is securely backup up of course.
  - theshrike79 2y ago
    The Yubikey setup program specifically tells you not to rely on a single key for anything.
  - iam-TJ 2y ago
    Even with LUKSv1 there are seven key slots. On creation generally the first will be a keyboard-entered pass-phrase, then one might add a key-file, and then add the hardware token as another. With LUKSv2 the seven slot limit doesn't apply. For headless GRUB is configured to the serial port for its terminal in/out so a passphrase can be typed.
- adriancr 2y ago
  What are the benefits of encryption here? If hardware is stolen it will have hardware key attached. It is similar to having unencrypted ssd. Also, someone can temporarily remove the yubikey, fetch the decryption key then place it back.
  - rfoo 2y ago
    > hardware key attached Key is on my keychain. not attached to the box. I don't need to unlock it remotely. I want to be there and plug my key and touch it and yank it. > Also, someone can temporarily remove the yubikey, fetch the decryption key then place it back. If implemented correctly. Nobody can. An encrypted LUKS key would be sent to the yubikey and have it decrypted there. Not the other way.
teddyh 2y ago
For unattended reboots with encrypted root disks (reboot while you sleep), use Mandos: <https://www.recompile.se/mandos https://www.recompile.se/mandos> Disclosure: I am a co-author of Mandos.

inductive_magic 2y ago

YubiKey

microtonal 2y ago
Or remote unlock: https://github.com/gsauthof/dracut-sshd https://github.com/gsauthof/dracut-sshd
- inductive_magic 2y ago
  Very cool, ty.

adriancr 2y ago

You can use "keyscript=" in "/etc/crypttab" to run any script you want. Using that you could set up networking and download the key from somewhere (say a remote KMS that would need user approval before continuing). So you would reduce your problem to being prompted on phone to unlock your desktop. You could even use some sort of hardware key to prove request came from the physical server. (simplest might be a RP2350 with some key burnt in) Or you could use something like SGX if it's still available anywhere to prove the same.

michaelt 2y ago
> You can use "keyscript=" in "/etc/crypttab" to run any script you want. ...unless your distro uses systemd, which removes keyscript support [1] because the systemd guy "really dislikes generic callouts" [1] https://github.com/systemd/systemd/pull/3007 https://github.com/systemd/systemd/pull/3007
- sterlind 2y ago
  you can apparently provide a Unix socket path in /etc/crypttab now, and it will connect and read the key from the socket. so you can have the same functionality, but you have to get at it a different way: https://github.com/systemd/systemd/pull/17524 https://github.com/systemd/systemd/pull/17524
- adriancr 2y ago
  It's 2024 and keyscript still works fine on ubuntu
  - aflukasz 2y ago
    I don't use this param at the moment anywhere to confirm experimentally, but I'm pretty sure it's same on Debian: https://salsa.debian.org/cryptsetup-team/cryptsetup/-/blob/70ec02716f451a0272e7b1fa46c081cb94f1e910/debian/functions#L274 https://salsa.debian.org/cryptsetup-team/cryptsetup/-/blob/7....
- pacificenigma 2y ago
  For years I've used https://github.com/anatol/booster https://github.com/anatol/booster to unlock LUKS partitions using network bound disk encryption with https://github.com/latchset/clevis https://github.com/latchset/clevis and https://github.com/latchset/tang https://github.com/latchset/tang. Works well, especially as Tang is stateless (so deployment and high availability is easy) and Booster falls back to password entry if Tang is unavailable.
  - aflukasz 2y ago
    Thumbs up for clevis/tang, happy user here, too! Did not hear about booster. Its README claims "Clevis style data binding. The encrypted filesystem can be bound to TPM2 chip or to a network service.". Does it mean that it tries to deliver various bindings independently from clevis pins, even when duplicating their functions?
- adsf325q3 2y ago
  [flagged]

iam-TJ 2y ago

If you are physically present but the device is operating headless, and if using LUKS and GRUB, you can use a hardware token such as YubiKey via USB to unlock the device without needing to see the console. I do this with a gateway/router on a PC Engines APU2 that has an internal SSD. Just ensure GRUB includes the requisite USB modules in its core image, or use grub-mkstandalone to include all modules in core.

tmikaeld 2y ago
Please don't do this unless you have a backup yubikey with the same key on it..
- teekert 2y ago
  Or all state-full data is securely backup up of course.
- theshrike79 2y ago
  The Yubikey setup program specifically tells you not to rely on a single key for anything.
- iam-TJ 2y ago
  Even with LUKSv1 there are seven key slots. On creation generally the first will be a keyboard-entered pass-phrase, then one might add a key-file, and then add the hardware token as another. With LUKSv2 the seven slot limit doesn't apply. For headless GRUB is configured to the serial port for its terminal in/out so a passphrase can be typed.
adriancr 2y ago
What are the benefits of encryption here? If hardware is stolen it will have hardware key attached. It is similar to having unencrypted ssd. Also, someone can temporarily remove the yubikey, fetch the decryption key then place it back.
- rfoo 2y ago
  > hardware key attached Key is on my keychain. not attached to the box. I don't need to unlock it remotely. I want to be there and plug my key and touch it and yank it. > Also, someone can temporarily remove the yubikey, fetch the decryption key then place it back. If implemented correctly. Nobody can. An encrypted LUKS key would be sent to the yubikey and have it decrypted there. Not the other way.

teddyh 2y ago

For unattended reboots with encrypted root disks (reboot while you sleep), use Mandos: <https://www.recompile.se/mandos https://www.recompile.se/mandos> Disclosure: I am a co-author of Mandos.