Groups > linux.debian.user > #200621

Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ???

From	Igor Cicimov <icicimov@gmail.com>
Newsgroups	linux.debian.user
Subject	Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ???
Date	2018-09-26 01:10 +0200
Message-ID	<wC4CR-852-5@gated-at.bofh.it> (permalink)
References	(6 earlier) <wyl9f-6FI-11@gated-at.bofh.it> <wyqLD-1vo-5@gated-at.bofh.it> <wyry2-1ZP-9@gated-at.bofh.it> <wz68a-v1-7@gated-at.bofh.it> <wzASB-1ID-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Wed, 19 Sep 2018 12:58 pm Andy Smith <andy@strugglers.net> wrote:

> Hello,
>
> On Mon, Sep 17, 2018 at 08:00:50PM +0200, Pascal Hambourg wrote:
> > Le 16/09/2018 à 00:39, Andy Smith a écrit :
> > >
> > >The obvious problem there is an attacker who gets hold of the
> > >initramfs in order to be able to use the credentials to request the
> > >passphrase themselves.
>
> […]
>
> > >     https://wiki.recompile.se/wiki/Mandos
>
> > How dos this address the above concern ?
>
> It is of course impossible to have both entirely automated unlocking
> and perfect protection against someone taking the credentials from
> the unencrypted bootstrap environment.
>
> Having a script in your initramfs that unlocks your encrypted
> filesystem provides no protection at all from someone who obtains a
> copy of your initramfs and your encrypted filesystem.
>
> You could add some more protection by using an online key/value
> store instead of hard-coded credentials, since the key/value server
> could also enforce things other than simple access to a file. For
> example, it could require the request to come from a certain IP
> address.
>
> Using something like Mandos is another step along this path, by
> requiring the unlock attempt to come within some short time period
> since the last time your server checked in. It has shifted the
> requirements from "have a copy of the encrypted filesystem and a
> copy of the initramfs" to "have a copy of the encrypted filesystem
> and the initramfs and be able to talk to the Mandos server from the
> correct IP address within the required time interval". All it can do
> is make the attack harder, not make it impossible.
>
> It also clearly adds a lot of opportunities for you to permanently
> lock yourself out of the encrypted filesystem by accident, unless
> you take the precaution of having another set of credentials for
> "emergency manual unlock" that you keep elsewhere.
>
> An attacker who is aware of requirements such as where the secrets
> server is, how to interact with it, where requests must come from,
> time window in which requests must be made, etc is not going to be
> defeated. Mandos's argument seems to be that such attackers are rare
> and will probably just use the law or techniques like memory dumping
> in preference to all that anyway.
>
>     https://www.recompile.se/mandos/man/intro.8mandos
>
>     "FREQUENTLY ASKED QUESTIONS
>
>     Couldn't the security be defeated by…
>
>     Grabbing the Mandos client key from the initrd really quickly?
>
>     This, as mentioned above, is the only real weak point. But if
>     you set the timing values tight enough, this will be really
>     difficult to do. An attacker would have to physically
>     disassemble the client computer, extract the key from the
>     initial RAM disk image, and then connect to a still online
>     Mandos server to get the encrypted key, and do all this before
>     the Mandos server timeout kicks in and the Mandos server refuses
>     to give out the key to anyone.
>
>     Now, as the typical procedure seems to be to barge in and turn
>     off and grab all computers, to maybe look at them months later,
>     this is not likely. If someone does that, the whole system will
>     lock itself up completely, since Mandos servers are no longer
>     running.
>
>     For sophisticated attackers who could do the clever thing, and
>     had physical access to the server for enough time, it would be
>     simpler to get a key for an encrypted file system by using
>     hardware memory scanners and reading it right off the memory
>     bus."
>
> Cheers,
> Andy
>
> --
> https://bitfolk.com/ -- No-nonsense VPS hosting
>

An example for automation with AWS using SSM and KMS services
https://icicimov.github.io/blog/server/LUKS-with-AWS-SSM-and-KMS-in-Systemd/
It can be modified for initramfs.

>

Thread

ext2 for /boot ??? -- WAS: Re: root on ZFS Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-11 20:10 +0200
  Re: ext2 for /boot ??? -- WAS: Re: root on ZFS Matthew Crews <mailinglists@mattcrews.com> - 2018-09-11 20:30 +0200
  Re: ext2 for /boot ??? -- WAS: Re: root on ZFS Michael Stone <mstone@debian.org> - 2018-09-11 20:40 +0200
  Re: ext2 for /boot ??? Felix Miata <mrmazda@earthlink.net> - 2018-09-12 01:40 +0200
    Re: ext2 for /boot ??? Lee <ler762@gmail.com> - 2018-09-12 05:40 +0200
      Re: ext2 for /boot ??? Mimiko <vbvbrj@gmail.com> - 2018-09-12 07:50 +0200
      Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-12 11:20 +0200
        Re: ext2 for /boot ??? Sven Joachim <svenjoac@gmx.de> - 2018-09-12 11:40 +0200
          Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-09-12 21:00 +0200
            Re: ext2 for /boot ??? Sven Joachim <svenjoac@gmx.de> - 2018-09-12 21:40 +0200
            Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-12 23:00 +0200
            Re: ext2 for /boot ??? Michael Stone <mstone@debian.org> - 2018-09-13 00:00 +0200
              Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-09-14 05:30 +0200
            Re: ext2 for /boot ??? Zenaan Harkness <zenaan@freedbms.net> - 2018-09-14 06:10 +0200
              Re: ext2 for /boot ??? Stefan Monnier <monnier@iro.umontreal.ca> - 2018-09-14 14:40 +0200
                Re: ext2 for /boot ??? Michael Stone <mstone@debian.org> - 2018-09-14 14:50 +0200
                Re: ext2 for /boot ??? Matthew Crews <mailinglists@mattcrews.com> - 2018-09-14 17:10 +0200
                Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-14 18:30 +0200
                Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-14 20:00 +0200
                Re: ext2 for /boot ??? Matthew Crews <mailinglists@mattcrews.com> - 2018-09-15 00:50 +0200
                Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-15 08:50 +0200
                Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-15 18:00 +0200
                Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-16 00:00 +0200
                Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andy Smith <andy@strugglers.net> - 2018-09-16 00:50 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-17 20:10 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-17 20:20 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-18 20:10 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andy Smith <andy@strugglers.net> - 2018-09-19 05:00 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-19 17:50 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Igor Cicimov <icicimov@gmail.com> - 2018-09-26 01:10 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-26 18:20 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-26 19:20 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-26 20:20 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-27 10:00 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-27 17:40 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Igor Cicimov <icicimov@gmail.com> - 2018-09-28 13:10 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Celejar <celejar@gmail.com> - 2018-09-30 03:20 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-30 08:50 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-30 12:10 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Celejar <celejar@gmail.com> - 2018-09-30 23:40 +0200
                Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-26 11:20 +0200
                Re: ext2 for /boot ??? Dan Ritter <dsr@randomstring.org> - 2018-09-14 15:10 +0200
                Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-14 20:50 +0200
                Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-09-15 00:10 +0200
                Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-15 09:20 +0200
                Re: ext2 for /boot ??? Celejar <celejar@gmail.com> - 2018-09-16 16:40 +0200
                Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-10-10 00:00 +0200
                Re: ext2 for /boot ??? Zenaan Harkness <zenaan@freedbms.net> - 2018-09-15 01:30 +0200
                Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-14 15:20 +0200
                Re: ext2 for /boot ??? Brad Rogers <brad@fineby.me.uk> - 2018-09-14 16:50 +0200
                Re: ext2 for /boot ??? Stefan Monnier <monnier@iro.umontreal.ca> - 2018-09-14 19:30 +0200
                Re: ext2 for /boot ??? Michael Stone <mstone@debian.org> - 2018-09-14 22:20 +0200
                Re: ext2 for /boot ??? Erik Christiansen <dvalin@internode.on.net> - 2018-09-15 08:50 +0200
                Re: ext2 for /boot ??? Gene Heskett <gheskett@shentel.net> - 2018-09-15 10:10 +0200
                The big, the bloated and the hungry (Was: ext2 for /boot ???) Étienne Mollier <etienne.mollier@mailoo.org> - 2018-09-15 10:20 +0200
                Re: The big, the bloated and the hungry Felix Miata <mrmazda@earthlink.net> - 2018-09-15 10:50 +0200
                Re: The big, the bloated and the hungry Étienne Mollier <etienne.mollier@mailoo.org> - 2018-09-15 11:30 +0200
                Re: The big, the bloated and the hungry Celejar <celejar@gmail.com> - 2018-09-16 16:50 +0200
                Re: The big, the bloated and the hungry Nicholas Geovanis <nickgeovanis@gmail.com> - 2018-09-18 19:00 +0200
                Re: The big, the bloated and the hungry Étienne Mollier <etienne.mollier@mailoo.org> - 2018-09-18 21:10 +0200
                Re: The big, the bloated and the hungry (Was: ext2 for /boot ???) Thakur Mahashaya <thmsh@yandex.ru> - 2018-09-15 12:50 +0200
                Re: The big, the bloated and the hungry (Was: ext2 for /boot ???) Thakur Mahashaya <thmsh@yandex.ru> - 2018-09-15 12:50 +0200
                Re: The big, the bloated and the hungry (Was: ext2 for /boot ???) Thakur Mahashaya <thmsh@yandex.ru> - 2018-09-15 13:00 +0200
                Re: The big, the bloated and the hungry etienne.mollier@mailoo.org - 2018-09-16 12:20 +0200
                Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-26 11:10 +0200
              Re: ext2 for /boot ??? Stefan Monnier <monnier@iro.umontreal.ca> - 2018-09-14 14:50 +0200
          Re: ext2 for /boot ??? Kenneth Parker <sea7kenp@gmail.com> - 2018-09-14 06:40 +0200
            Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-09-14 17:40 +0200
              Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-14 21:00 +0200
          Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-26 11:10 +0200
    Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-12 08:10 +0200
      Re: ext2 for /boot ??? Felix Miata <mrmazda@earthlink.net> - 2018-09-12 08:20 +0200
        Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-12 09:00 +0200
        Re: ext2 for /boot ??? Brad Rogers <brad@fineby.me.uk> - 2018-09-12 11:20 +0200
          Re: ext2 for /boot ??? Felix Miata <mrmazda@earthlink.net> - 2018-09-12 12:30 +0200
        Re: ext2 for /boot ??? Michael Stone <mstone@debian.org> - 2018-09-12 15:50 +0200
          Re: ext2 for /boot ??? Glenn English <ghe2001@gmail.com> - 2018-09-12 17:40 +0200
            Re: ext2 for /boot ??? Brad Rogers <brad@fineby.me.uk> - 2018-09-12 18:00 +0200
            Re: ext2 for /boot ??? Felix Miata <mrmazda@earthlink.net> - 2018-09-12 18:30 +0200
  Re: ext2 for /boot ??? -- WAS: Re: root on ZFS <tomas@tuxteam.de> - 2018-09-12 09:50 +0200

csiph-web