Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #200765
| From | Celejar <celejar@gmail.com> |
|---|---|
| Newsgroups | linux.debian.user |
| Subject | Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? |
| Date | 2018-09-30 03:20 +0200 |
| Message-ID | <wDyyR-42Q-5@gated-at.bofh.it> (permalink) |
| References | (7 earlier) <wzASB-1ID-1@gated-at.bofh.it> <wC4CR-852-5@gated-at.bofh.it> <wCkHE-CU-5@gated-at.bofh.it> <wClDH-1aa-1@gated-at.bofh.it> <wCznj-EB-1@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Thu, 27 Sep 2018 17:54:26 +1000 Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> wrote: ... > The biggest weakness with the Dropbear setup is that the initramfs is > stored on an unencrypted partition (no matter which file system is > used). That means that someone with physical access can rebuild the > initramfs and include their own key as well as other stuff to > compromise the security of the server. > > Aside from the fact that the IME is suspect, it would be great if grub > can be, somehow, given a method that allows for full disk encryption > which will include everything in /boot -- especially initramfs. But grub itself and its configuration can't be encrypted, so an attacker could still compromise that code / data. IIUC, your solution basically just implies moving some of the logic currently in the initramfs into grub. One solution is to run grub from removable media, and preventing attackers from getting physical access to it ... Disclaimer: I'm no expert, and am just expressing my understanding of the underlying unsolvable problem based on what I've read about it. Celejar
Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
ext2 for /boot ??? -- WAS: Re: root on ZFS Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-11 20:10 +0200
Re: ext2 for /boot ??? -- WAS: Re: root on ZFS Matthew Crews <mailinglists@mattcrews.com> - 2018-09-11 20:30 +0200
Re: ext2 for /boot ??? -- WAS: Re: root on ZFS Michael Stone <mstone@debian.org> - 2018-09-11 20:40 +0200
Re: ext2 for /boot ??? Felix Miata <mrmazda@earthlink.net> - 2018-09-12 01:40 +0200
Re: ext2 for /boot ??? Lee <ler762@gmail.com> - 2018-09-12 05:40 +0200
Re: ext2 for /boot ??? Mimiko <vbvbrj@gmail.com> - 2018-09-12 07:50 +0200
Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-12 11:20 +0200
Re: ext2 for /boot ??? Sven Joachim <svenjoac@gmx.de> - 2018-09-12 11:40 +0200
Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-09-12 21:00 +0200
Re: ext2 for /boot ??? Sven Joachim <svenjoac@gmx.de> - 2018-09-12 21:40 +0200
Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-12 23:00 +0200
Re: ext2 for /boot ??? Michael Stone <mstone@debian.org> - 2018-09-13 00:00 +0200
Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-09-14 05:30 +0200
Re: ext2 for /boot ??? Zenaan Harkness <zenaan@freedbms.net> - 2018-09-14 06:10 +0200
Re: ext2 for /boot ??? Stefan Monnier <monnier@iro.umontreal.ca> - 2018-09-14 14:40 +0200
Re: ext2 for /boot ??? Michael Stone <mstone@debian.org> - 2018-09-14 14:50 +0200
Re: ext2 for /boot ??? Matthew Crews <mailinglists@mattcrews.com> - 2018-09-14 17:10 +0200
Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-14 18:30 +0200
Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-14 20:00 +0200
Re: ext2 for /boot ??? Matthew Crews <mailinglists@mattcrews.com> - 2018-09-15 00:50 +0200
Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-15 08:50 +0200
Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-15 18:00 +0200
Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-16 00:00 +0200
Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andy Smith <andy@strugglers.net> - 2018-09-16 00:50 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-17 20:10 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-17 20:20 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-18 20:10 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andy Smith <andy@strugglers.net> - 2018-09-19 05:00 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-19 17:50 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Igor Cicimov <icicimov@gmail.com> - 2018-09-26 01:10 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-26 18:20 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-26 19:20 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-26 20:20 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-27 10:00 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-27 17:40 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Igor Cicimov <icicimov@gmail.com> - 2018-09-28 13:10 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Celejar <celejar@gmail.com> - 2018-09-30 03:20 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-30 08:50 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-30 12:10 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Celejar <celejar@gmail.com> - 2018-09-30 23:40 +0200
Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-26 11:20 +0200
Re: ext2 for /boot ??? Dan Ritter <dsr@randomstring.org> - 2018-09-14 15:10 +0200
Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-14 20:50 +0200
Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-09-15 00:10 +0200
Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-15 09:20 +0200
Re: ext2 for /boot ??? Celejar <celejar@gmail.com> - 2018-09-16 16:40 +0200
Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-10-10 00:00 +0200
Re: ext2 for /boot ??? Zenaan Harkness <zenaan@freedbms.net> - 2018-09-15 01:30 +0200
Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-14 15:20 +0200
Re: ext2 for /boot ??? Brad Rogers <brad@fineby.me.uk> - 2018-09-14 16:50 +0200
Re: ext2 for /boot ??? Stefan Monnier <monnier@iro.umontreal.ca> - 2018-09-14 19:30 +0200
Re: ext2 for /boot ??? Michael Stone <mstone@debian.org> - 2018-09-14 22:20 +0200
Re: ext2 for /boot ??? Erik Christiansen <dvalin@internode.on.net> - 2018-09-15 08:50 +0200
Re: ext2 for /boot ??? Gene Heskett <gheskett@shentel.net> - 2018-09-15 10:10 +0200
The big, the bloated and the hungry (Was: ext2 for /boot ???) Étienne Mollier <etienne.mollier@mailoo.org> - 2018-09-15 10:20 +0200
Re: The big, the bloated and the hungry Felix Miata <mrmazda@earthlink.net> - 2018-09-15 10:50 +0200
Re: The big, the bloated and the hungry Étienne Mollier <etienne.mollier@mailoo.org> - 2018-09-15 11:30 +0200
Re: The big, the bloated and the hungry Celejar <celejar@gmail.com> - 2018-09-16 16:50 +0200
Re: The big, the bloated and the hungry Nicholas Geovanis <nickgeovanis@gmail.com> - 2018-09-18 19:00 +0200
Re: The big, the bloated and the hungry Étienne Mollier <etienne.mollier@mailoo.org> - 2018-09-18 21:10 +0200
Re: The big, the bloated and the hungry (Was: ext2 for /boot ???) Thakur Mahashaya <thmsh@yandex.ru> - 2018-09-15 12:50 +0200
Re: The big, the bloated and the hungry (Was: ext2 for /boot ???) Thakur Mahashaya <thmsh@yandex.ru> - 2018-09-15 12:50 +0200
Re: The big, the bloated and the hungry (Was: ext2 for /boot ???) Thakur Mahashaya <thmsh@yandex.ru> - 2018-09-15 13:00 +0200
Re: The big, the bloated and the hungry etienne.mollier@mailoo.org - 2018-09-16 12:20 +0200
Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-26 11:10 +0200
Re: ext2 for /boot ??? Stefan Monnier <monnier@iro.umontreal.ca> - 2018-09-14 14:50 +0200
Re: ext2 for /boot ??? Kenneth Parker <sea7kenp@gmail.com> - 2018-09-14 06:40 +0200
Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-09-14 17:40 +0200
Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-14 21:00 +0200
Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-26 11:10 +0200
Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-12 08:10 +0200
Re: ext2 for /boot ??? Felix Miata <mrmazda@earthlink.net> - 2018-09-12 08:20 +0200
Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-12 09:00 +0200
Re: ext2 for /boot ??? Brad Rogers <brad@fineby.me.uk> - 2018-09-12 11:20 +0200
Re: ext2 for /boot ??? Felix Miata <mrmazda@earthlink.net> - 2018-09-12 12:30 +0200
Re: ext2 for /boot ??? Michael Stone <mstone@debian.org> - 2018-09-12 15:50 +0200
Re: ext2 for /boot ??? Glenn English <ghe2001@gmail.com> - 2018-09-12 17:40 +0200
Re: ext2 for /boot ??? Brad Rogers <brad@fineby.me.uk> - 2018-09-12 18:00 +0200
Re: ext2 for /boot ??? Felix Miata <mrmazda@earthlink.net> - 2018-09-12 18:30 +0200
Re: ext2 for /boot ??? -- WAS: Re: root on ZFS <tomas@tuxteam.de> - 2018-09-12 09:50 +0200
csiph-web