3 ms·
You can use "keyscript=" in "/etc/crypttab" to run any script you want. Using that you could set up networking and download the key from somewhere (say a remot
by adriancr 2y ago
You can use "keyscript=" in "/etc/crypttab" to run any script you want.
Using that you could set up networking and download the key from somewhere (say a remote KMS that would need user approval before continuing). So you would reduce your problem to being prompted on phone to unlock your desktop.
You could even use some sort of hardware key to prove request came from the physical server. (simplest might be a RP2350 with some key burnt in)
Or you could use something like SGX if it's still available anywhere to prove the same.
- michaelt 2y ago> You can use "keyscript=" in "/etc/crypttab" to run any script you want. ...unless your distro uses systemd, which removes keyscript support [1] because the systemd guy "really dislikes generic callouts" [1] https://github.com/systemd/systemd/pull/3007 https://github.com/systemd/systemd/pull/3007
- sterlind 2y agoyou can apparently provide a Unix socket path in /etc/crypttab now, and it will connect and read the key from the socket. so you can have the same functionality, but you have to get at it a different way: https://github.com/systemd/systemd/pull/17524 https://github.com/systemd/systemd/pull/17524
- adriancr 2y agoIt's 2024 and keyscript still works fine on ubuntu
- aflukasz 2y agoI don't use this param at the moment anywhere to confirm experimentally, but I'm pretty sure it's same on Debian: https://salsa.debian.org/cryptsetup-team/cryptsetup/-/blob/70ec02716f451a0272e7b1fa46c081cb94f1e910/debian/functions#L274 https://salsa.debian.org/cryptsetup-team/cryptsetup/-/blob/7....
- pacificenigma 2y agoFor years I've used https://github.com/anatol/booster https://github.com/anatol/booster to unlock LUKS partitions using network bound disk encryption with https://github.com/latchset/clevis https://github.com/latchset/clevis and https://github.com/latchset/tang https://github.com/latchset/tang. Works well, especially as Tang is stateless (so deployment and high availability is easy) and Booster falls back to password entry if Tang is unavailable.
- aflukasz 2y agoThumbs up for clevis/tang, happy user here, too! Did not hear about booster. Its README claims "Clevis style data binding. The encrypted filesystem can be bound to TPM2 chip or to a network service.". Does it mean that it tries to deliver various bindings independently from clevis pins, even when duplicating their functions?
- adsf325q3 2y ago[flagged]