[synapseattack]

Hi all,

Hopefully someone can point me in the right direction on this.

I am trying to create a install of the OS which is installed on an encrypted disk that will mount automatically upon install without any user intervention. I have tried LUKS and pretty much regardless of what I do it is always asking for the password at boot time or needs an unencrypted volume from which to retrieve a key from.

These are basically for servers which will be in a colo, so even though the cage is locked and i should not have anything to worry about I want to make sure that the hard drive can not be swiped and mounted in another linux system. So far the only thing I have found to be close is LUKS which requires that a key file or password be entered. If I have to reboot remotely I don't want to have to give this info out to anyone.

Any help at all that anyone can provide would be great and you would have my appreciation. Even if it is just a simple RTFM on a different piece of software

~SA

[kakariko81280]

You are trying to implement two conflicting requirements. Specifically "Works completely automatically in my computer" and "Can't work otherwise". If the key is on the system to allow automatic mounting then the attacker can steal it, probably without realising, by stealing the HDD. If the key isn't there then it will have to ask for it.

On the other hand, you may not need to encrypt the entire system. I'd approach this by making sure the system can boot to at least a minimally operational state by itself, then ssh in and set up the encrypted partition providing the password remotely. Then you can kick off the remainder of the boot process.

If you are feeling ultra paranoid then there are a few ways this could go wrong, but it seems like a reasonable start.

Let us know how you get on,

Chris...

[synapseattack]

In that case lets try another way.

Is it possible to get LUKS to look for a key file with a URL?

I suppose I could do a startup script that download the file and mount the encrypted file but if there is a built in or already tested and tried way to do it all the better.

[kakariko81280]

I don't think there is a native way to get cryptsetup to download keys from the Internet.

Although you could script such a task, it leaves you with the options of posting your private key publicly, or password protecting it and storing that password in the clear on the drive you are trying to protect.

I personally think both of these options are less secure than ssh-ing into a partially booted system to mount the encrypted volumes manually.

Let us know how you get on,

Chris...