3 ms·

> Entering a password on boot isn't even that much work It is on fedora. I wabt the latest packages and I want to install them with dnf offline upgrade but now

by mcny 2y ago

> Entering a password on boot isn't even that much work It is on fedora. I wabt the latest packages and I want to install them with dnf offline upgrade but now I need to put in password twice once for the updates d again for next boot. If it is a server, I don't want to keep a monitor attached to it just to enter the password. I want the computer to just boot. There has to be a better way.

bpye 2y ago
Is the boot time password unlock occurring in GRUB or after the Linux kernel has started? If the latter you should be able to setup an SSH server to run in that early boot environment, that’s how I can remote unlock drives on NixOS.
keeperofdakeys 2y ago
> There has to be a better way. Probably Clevis and Tang, network disk decryption that can only decrypt if most of your servers are online. https://github.com/latchset/clevis https://github.com/latchset/clevis https://github.com/latchset/tang https://github.com/latchset/tang Or network decryption (SSH into initrd). https://github.com/gsauthof/dracut-sshd https://github.com/gsauthof/dracut-sshd
johnisgood 2y ago
There is: https://news.ycombinator.com/item?id=42734841 https://news.ycombinator.com/item?id=42734841.
webstrand 2y ago
There is, I use kexec to boot a modified cpio containing the fde password, since cpio can be extended by concatenation. https://gist.github.com/webstrand/381307348e24c28d5c4c9a5981871bd7 https://gist.github.com/webstrand/381307348e24c28d5c4c9a5981... It's the same technique grub uses to forward the FDE password to the initramfs after its own initial decryption (to read the kernel and initramfs). This works to reboot remote servers with FDE, without needing a vnc or earlyboot-sshd.
prmoustache 2y ago
I also use a fedora. Typically I use offline upgrade if I mean to poweroff but otherwise I just run `sudo dnf update -y && sudo systemctl reboot` in a terminal if I want a quick update&reboot. On another laptop I am using silverblue (well bluefin) and the atomic upgrades solve the issue completely.

by mcny 2y ago

bpye 2y ago

Is the boot time password unlock occurring in GRUB or after the Linux kernel has started? If the latter you should be able to setup an SSH server to run in that early boot environment, that’s how I can remote unlock drives on NixOS.

keeperofdakeys 2y ago

> There has to be a better way. Probably Clevis and Tang, network disk decryption that can only decrypt if most of your servers are online. https://github.com/latchset/clevis https://github.com/latchset/clevis https://github.com/latchset/tang https://github.com/latchset/tang Or network decryption (SSH into initrd). https://github.com/gsauthof/dracut-sshd https://github.com/gsauthof/dracut-sshd

johnisgood 2y ago

There is: https://news.ycombinator.com/item?id=42734841 https://news.ycombinator.com/item?id=42734841.

webstrand 2y ago

There is, I use kexec to boot a modified cpio containing the fde password, since cpio can be extended by concatenation. https://gist.github.com/webstrand/381307348e24c28d5c4c9a5981871bd7 https://gist.github.com/webstrand/381307348e24c28d5c4c9a5981... It's the same technique grub uses to forward the FDE password to the initramfs after its own initial decryption (to read the kernel and initramfs). This works to reboot remote servers with FDE, without needing a vnc or earlyboot-sshd.

prmoustache 2y ago

I also use a fedora. Typically I use offline upgrade if I mean to poweroff but otherwise I just run `sudo dnf update -y && sudo systemctl reboot` in a terminal if I want a quick update&reboot. On another laptop I am using silverblue (well bluefin) and the atomic upgrades solve the issue completely.