Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #229920 > unrolled thread

Discussion about backup passwords for LUKS encrypted filesystems before revising wiki

Back to article view | Back to linux.debian.user

Contents

  Discussion about backup passwords for LUKS encrypted filesystems before revising wiki rhkramer@gmail.com - 2020-12-22 18:20 +0100
    Re: Discussion about backup passwords for LUKS encrypted filesystems  before revising wiki Roberto C. Sánchez <roberto@debian.org> - 2020-12-22 18:40 +0100
      Re: Discussion about backup passwords for LUKS encrypted filesystems before revising wiki rhkramer@gmail.com - 2020-12-22 19:10 +0100
    Re: Discussion about backup passwords for LUKS encrypted filesystems  before revising wiki David Christensen <dpchrist@holgerdanske.com> - 2020-12-23 01:30 +0100
    Re: Discussion about backup passwords for LUKS encrypted filesystems  before revising wiki Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-23 15:10 +0100

#229920 — Discussion about backup passwords for LUKS encrypted filesystems before revising wiki

See the quoted paragraph, below, quoted from the 
[[https://wiki.debian.org/LVM#Encrypted_LVM][LVM#Encrypted_LVM]] wiki.  

It seems to me that the idea of creating and saving backup passwords is 
something of a red herring (to borrow a "Briticism").

The way I see it:

   * if, in the future: "somehow you<sic> first password is no longer working" 
-- I'm guessing that whatever that "somehow" is, it is likely to affect all the 
passwords (all of which are stored in the LUKS header)

   * or if: "you simply forget your password" -- it seems unlikely that you'll 
forget the "normal" password (the one you most often use) but remember a 
backup password (although maybe you'd use something really easy to remember 
(for you), and hope that because you don't normally use it, it is less exposed 
and less likely to be captured somehow)

   * or if: "something unexpected happens such as a bug after a kernel update 
and somehow the password is no longer working" -- it seems likely to me that 
if a kernel bug makes one password no longer work, it would be likely that 
none of the passwords not to work (although I think I can think of exceptions, 
e.g., your password contains a special symbol, but a kernel bug (or bug 
somewhere) prevents entry of that special symbol

My point is this: I think creating and saving backup passwords is of minimal 
value.  Far more important (but not mentioned) is making and keeping backup 
copies of your encrypted data (possibly not encrypted but stored in a bank 
vault ;-), yet that is not mentioned.

I am capable (or think I'm capable ;-) of revising the wiki to add a statement 
to the effect that, more important than storing backup passwords is storing 
backups of the actual data.  I just wanted to provoke some discussion before 
making such a revision.  (I might even downplay the emphasis on creating and 
storing backup passwords.)

<quote>
Note: The password(s) of a encrypted LVM volume are stored inside its Linux 
Unified Key Setup (LUKS) header(s). Creating backup passwords is important 
because if in the future somehow you first password is no longer working, or 
you simply forget your password, or you do remember your password but 
something unexpected happens such as a bug after a kernel update and somehow 
the password is no longer working, then without backup password(s) you risk to 
permanently lose all your valuable data stored into that encrypted LVM 
storage.
</quote>

[toc] | [next] | [standalone]

#229921 — Re: Discussion about backup passwords for LUKS encrypted filesystems before revising wiki

On Tue, Dec 22, 2020 at 12:11:19PM -0500, rhkramer@gmail.com wrote:
> 
> My point is this: I think creating and saving backup passwords is of minimal 
> value.  

Maybe to you as a single user.  However, I have worked in places where
resources are protected by multiple passwords.  For instance there was a
"normal" password given to the admins (or users, as the case may be) and
a backup password was kept locked in a safe.  The backup password could
be used if there was some sort of emergency where for some reason those
who would normally have the password were not available.  (Think
disaster recovery.)

Based on the content in the wiki it seems appropriate to inform the
reader of the presence of the ability to store multiple passwords which
can unlock an encrypted device.

> Far more important (but not mentioned) is making and keeping backup 
> copies of your encrypted data (possibly not encrypted but stored in a bank 
> vault ;-), yet that is not mentioned.
> 

It probably is not mentioned since backups are not something which are
unique to encrypted devices.  A general reminder would not be wrong or
bad, but it would seem out of place to me.  I mean, we could also add
reminders to make sure the firewall is up to date, secured, and enabled
or to have SMART enabled and configured to send alerts if a HDD begins
to exhibit symptoms of a potential failure.

Regards,

-Roberto

-- 
Roberto C. Sánchez

[toc] | [prev] | [next] | [standalone]

#229922

Roberto,

Thanks for the reply!

Good points, both of them.  I might (or might not) add your use case (the 
multiple user case) to the wiki as it sounds like a more plausible need.

On Tuesday, December 22, 2020 12:34:12 PM Roberto C. Sánchez wrote:
> On Tue, Dec 22, 2020 at 12:11:19PM -0500, rhkramer@gmail.com wrote:
> > My point is this: I think creating and saving backup passwords is of
> > minimal value.
> 
> Maybe to you as a single user.  However, I have worked in places where
> resources are protected by multiple passwords.  For instance there was a
> "normal" password given to the admins (or users, as the case may be) and
> a backup password was kept locked in a safe.  The backup password could
> be used if there was some sort of emergency where for some reason those
> who would normally have the password were not available.  (Think
> disaster recovery.)
> 
> Based on the content in the wiki it seems appropriate to inform the
> reader of the presence of the ability to store multiple passwords which
> can unlock an encrypted device.
> 
> > Far more important (but not mentioned) is making and keeping backup
> > copies of your encrypted data (possibly not encrypted but stored in a
> > bank vault ;-), yet that is not mentioned.
> 
> It probably is not mentioned since backups are not something which are
> unique to encrypted devices.  A general reminder would not be wrong or
> bad, but it would seem out of place to me.  I mean, we could also add
> reminders to make sure the firewall is up to date, secured, and enabled
> or to have SMART enabled and configured to send alerts if a HDD begins
> to exhibit symptoms of a potential failure.
> 
> Regards,
> 
> -Roberto

[toc] | [prev] | [next] | [standalone]

#229926 — Re: Discussion about backup passwords for LUKS encrypted filesystems before revising wiki

On 2020-12-22 09:11, rhkramer@gmail.com wrote:
> See the quoted paragraph, below, quoted from the
> [[https://wiki.debian.org/LVM#Encrypted_LVM][LVM#Encrypted_LVM]] wiki.
> 
> It seems to me that the idea of creating and saving backup passwords is
> something of a red herring (to borrow a "Briticism").
> 
> The way I see it:
> 
>     * if, in the future: "somehow you<sic> first password is no longer working"
> -- I'm guessing that whatever that "somehow" is, it is likely to affect all the
> passwords (all of which are stored in the LUKS header)
> 
>     * or if: "you simply forget your password" -- it seems unlikely that you'll
> forget the "normal" password (the one you most often use) but remember a
> backup password (although maybe you'd use something really easy to remember
> (for you), and hope that because you don't normally use it, it is less exposed
> and less likely to be captured somehow)
> 
>     * or if: "something unexpected happens such as a bug after a kernel update
> and somehow the password is no longer working" -- it seems likely to me that
> if a kernel bug makes one password no longer work, it would be likely that
> none of the passwords not to work (although I think I can think of exceptions,
> e.g., your password contains a special symbol, but a kernel bug (or bug
> somewhere) prevents entry of that special symbol
> 
> My point is this: I think creating and saving backup passwords is of minimal
> value.  Far more important (but not mentioned) is making and keeping backup
> copies of your encrypted data (possibly not encrypted but stored in a bank
> vault ;-), yet that is not mentioned.
> 
> I am capable (or think I'm capable ;-) of revising the wiki to add a statement
> to the effect that, more important than storing backup passwords is storing
> backups of the actual data.  I just wanted to provoke some discussion before
> making such a revision.  (I might even downplay the emphasis on creating and
> storing backup passwords.)
> 
> <quote>
> Note: The password(s) of a encrypted LVM volume are stored inside its Linux
> Unified Key Setup (LUKS) header(s). Creating backup passwords is important
> because if in the future somehow you first password is no longer working, or
> you simply forget your password, or you do remember your password but
> something unexpected happens such as a bug after a kernel update and somehow
> the password is no longer working, then without backup password(s) you risk to
> permanently lose all your valuable data stored into that encrypted LVM
> storage.
> </quote>

Thank you for offering to improve Debian documentation.  :-)


I agree that the content of "LVM" Debian Wiki page "Encrypted LVM" 
section could use some improvement.


AIUI backing up aLinux Unified Key Setup (LUKS) header will save a copy 
of the metadata for a LUKS volume, which includes secure hashes of the 
passphrases (and/or keys) used to access the contents (such as a Linux 
Volume Manager (LVM) volume).  So, while "Backup passwords" -> "Step" -> 
2.1 and "Restore password" -> 1.1 may describe useful system 
administration procedures, these subsections have conceptual and 
technical issues.


The subjects of multiple passphrases and/or keys for encrypted items 
(volumes, filesystems, directories, files, etc.) and disaster 
preparedness/ recovery of encrypted volumes and/or containers are 
related, but different.  Regarding the first subject and LUKS, I would 
expect the first to appear on a wiki page for "LUKS" (which does not 
appear to exist).  The latter subject for LUKS could be a useful 
addition to the "BackupAndRecovery" wiki page:

     https://wiki.debian.org/BackupAndRecovery


David

[toc] | [prev] | [next] | [standalone]

#229937 — Re: Discussion about backup passwords for LUKS encrypted filesystems before revising wiki

[Multipart message — attachments visible in raw view] — view raw

On Ma, 22 dec 20, 12:11:19, rhkramer@gmail.com wrote:
> 
>    * or if: "you simply forget your password" -- it seems unlikely that you'll 
> forget the "normal" password (the one you most often use) but remember a 
> backup password (although maybe you'd use something really easy to remember 
> (for you), and hope that because you don't normally use it, it is less exposed 
> and less likely to be captured somehow)

Or you create a very secure backup password and keep it in a safe 
(place), possibly even remote. 

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web