Groups > linux.debian.user > #200710

Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ???

From	Igor Cicimov <icicimov@gmail.com>
Newsgroups	linux.debian.user
Subject	Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ???
Date	2018-09-28 13:10 +0200
Message-ID	<wCYOJ-877-5@gated-at.bofh.it> (permalink)
References	(8 earlier) <wC4CR-852-5@gated-at.bofh.it> <wCkHE-CU-5@gated-at.bofh.it> <wClDH-1aa-1@gated-at.bofh.it> <wCznj-EB-1@gated-at.bofh.it> <wCGyt-4Zn-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Fri, Sep 28, 2018 at 1:32 AM deloptes <deloptes@gmail.com> wrote:

> Andrew McGlashan wrote:
>
> > The biggest weakness with the Dropbear setup is that the initramfs is
> > stored on an unencrypted partition (no matter which file system is
> > used).  That means that someone with physical access can rebuild the
> > initramfs and include their own key as well as other stuff to
> > compromise the security of the server.
> >
> Exactly what I was saying
>
> > Aside from the fact that the IME is suspect, it would be great if grub
> > can be, somehow, given a method that allows for full disk encryption
> > which will include everything in /boot -- especially initramfs.
> >
>
> but it would also mean that it should be accessible over the internet,
> because I do not see any other way to reach the server and decrypt.
>
>
> > Even so, then grub might have another attack vector of itself.  But it
> > would at least allow for encrypted /boot ...
>
> Well but again we shift from the boot partition to grub - hense if
> probability that one has physical access to the server can be ignored,
> dropbear is still practical solution.
>
> regards
>

That's why the reverse scenario is better, you include a client SSH key in
the initramfs which you use to ssh to a remote server and download the
encryption key.

The way I see it an important part of all these remote storage methods,
apart from automation, is prevention and remediation. First it can limit
the resource access from only specific IP(s) so If someone heads off with
your encrypted disk your data will stay protected since the key can not be
retrieved from anywhere else but your IP. And second, although it seems
that you have just replaced one kind of plain text credentials (the
encryption key) with another one (ssh key or AWS IAM user credentials), you
can actually still protect yourself by revoking those credentials on the
remote server/storage side upon a security incident.

Thread

ext2 for /boot ??? -- WAS: Re: root on ZFS Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-11 20:10 +0200
  Re: ext2 for /boot ??? -- WAS: Re: root on ZFS Matthew Crews <mailinglists@mattcrews.com> - 2018-09-11 20:30 +0200
  Re: ext2 for /boot ??? -- WAS: Re: root on ZFS Michael Stone <mstone@debian.org> - 2018-09-11 20:40 +0200
  Re: ext2 for /boot ??? Felix Miata <mrmazda@earthlink.net> - 2018-09-12 01:40 +0200
    Re: ext2 for /boot ??? Lee <ler762@gmail.com> - 2018-09-12 05:40 +0200
      Re: ext2 for /boot ??? Mimiko <vbvbrj@gmail.com> - 2018-09-12 07:50 +0200
      Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-12 11:20 +0200
        Re: ext2 for /boot ??? Sven Joachim <svenjoac@gmx.de> - 2018-09-12 11:40 +0200
          Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-09-12 21:00 +0200
            Re: ext2 for /boot ??? Sven Joachim <svenjoac@gmx.de> - 2018-09-12 21:40 +0200
            Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-12 23:00 +0200
            Re: ext2 for /boot ??? Michael Stone <mstone@debian.org> - 2018-09-13 00:00 +0200
              Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-09-14 05:30 +0200
            Re: ext2 for /boot ??? Zenaan Harkness <zenaan@freedbms.net> - 2018-09-14 06:10 +0200
              Re: ext2 for /boot ??? Stefan Monnier <monnier@iro.umontreal.ca> - 2018-09-14 14:40 +0200
                Re: ext2 for /boot ??? Michael Stone <mstone@debian.org> - 2018-09-14 14:50 +0200
                Re: ext2 for /boot ??? Matthew Crews <mailinglists@mattcrews.com> - 2018-09-14 17:10 +0200
                Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-14 18:30 +0200
                Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-14 20:00 +0200
                Re: ext2 for /boot ??? Matthew Crews <mailinglists@mattcrews.com> - 2018-09-15 00:50 +0200
                Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-15 08:50 +0200
                Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-15 18:00 +0200
                Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-16 00:00 +0200
                Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andy Smith <andy@strugglers.net> - 2018-09-16 00:50 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-17 20:10 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-17 20:20 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-18 20:10 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andy Smith <andy@strugglers.net> - 2018-09-19 05:00 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-19 17:50 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Igor Cicimov <icicimov@gmail.com> - 2018-09-26 01:10 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-26 18:20 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-26 19:20 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-26 20:20 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-27 10:00 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-27 17:40 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Igor Cicimov <icicimov@gmail.com> - 2018-09-28 13:10 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Celejar <celejar@gmail.com> - 2018-09-30 03:20 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-30 08:50 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-30 12:10 +0200
                Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Celejar <celejar@gmail.com> - 2018-09-30 23:40 +0200
                Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-26 11:20 +0200
                Re: ext2 for /boot ??? Dan Ritter <dsr@randomstring.org> - 2018-09-14 15:10 +0200
                Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-14 20:50 +0200
                Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-09-15 00:10 +0200
                Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-15 09:20 +0200
                Re: ext2 for /boot ??? Celejar <celejar@gmail.com> - 2018-09-16 16:40 +0200
                Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-10-10 00:00 +0200
                Re: ext2 for /boot ??? Zenaan Harkness <zenaan@freedbms.net> - 2018-09-15 01:30 +0200
                Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-14 15:20 +0200
                Re: ext2 for /boot ??? Brad Rogers <brad@fineby.me.uk> - 2018-09-14 16:50 +0200
                Re: ext2 for /boot ??? Stefan Monnier <monnier@iro.umontreal.ca> - 2018-09-14 19:30 +0200
                Re: ext2 for /boot ??? Michael Stone <mstone@debian.org> - 2018-09-14 22:20 +0200
                Re: ext2 for /boot ??? Erik Christiansen <dvalin@internode.on.net> - 2018-09-15 08:50 +0200
                Re: ext2 for /boot ??? Gene Heskett <gheskett@shentel.net> - 2018-09-15 10:10 +0200
                The big, the bloated and the hungry (Was: ext2 for /boot ???) Étienne Mollier <etienne.mollier@mailoo.org> - 2018-09-15 10:20 +0200
                Re: The big, the bloated and the hungry Felix Miata <mrmazda@earthlink.net> - 2018-09-15 10:50 +0200
                Re: The big, the bloated and the hungry Étienne Mollier <etienne.mollier@mailoo.org> - 2018-09-15 11:30 +0200
                Re: The big, the bloated and the hungry Celejar <celejar@gmail.com> - 2018-09-16 16:50 +0200
                Re: The big, the bloated and the hungry Nicholas Geovanis <nickgeovanis@gmail.com> - 2018-09-18 19:00 +0200
                Re: The big, the bloated and the hungry Étienne Mollier <etienne.mollier@mailoo.org> - 2018-09-18 21:10 +0200
                Re: The big, the bloated and the hungry (Was: ext2 for /boot ???) Thakur Mahashaya <thmsh@yandex.ru> - 2018-09-15 12:50 +0200
                Re: The big, the bloated and the hungry (Was: ext2 for /boot ???) Thakur Mahashaya <thmsh@yandex.ru> - 2018-09-15 12:50 +0200
                Re: The big, the bloated and the hungry (Was: ext2 for /boot ???) Thakur Mahashaya <thmsh@yandex.ru> - 2018-09-15 13:00 +0200
                Re: The big, the bloated and the hungry etienne.mollier@mailoo.org - 2018-09-16 12:20 +0200
                Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-26 11:10 +0200
              Re: ext2 for /boot ??? Stefan Monnier <monnier@iro.umontreal.ca> - 2018-09-14 14:50 +0200
          Re: ext2 for /boot ??? Kenneth Parker <sea7kenp@gmail.com> - 2018-09-14 06:40 +0200
            Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-09-14 17:40 +0200
              Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-14 21:00 +0200
          Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-26 11:10 +0200
    Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-12 08:10 +0200
      Re: ext2 for /boot ??? Felix Miata <mrmazda@earthlink.net> - 2018-09-12 08:20 +0200
        Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-12 09:00 +0200
        Re: ext2 for /boot ??? Brad Rogers <brad@fineby.me.uk> - 2018-09-12 11:20 +0200
          Re: ext2 for /boot ??? Felix Miata <mrmazda@earthlink.net> - 2018-09-12 12:30 +0200
        Re: ext2 for /boot ??? Michael Stone <mstone@debian.org> - 2018-09-12 15:50 +0200
          Re: ext2 for /boot ??? Glenn English <ghe2001@gmail.com> - 2018-09-12 17:40 +0200
            Re: ext2 for /boot ??? Brad Rogers <brad@fineby.me.uk> - 2018-09-12 18:00 +0200
            Re: ext2 for /boot ??? Felix Miata <mrmazda@earthlink.net> - 2018-09-12 18:30 +0200
  Re: ext2 for /boot ??? -- WAS: Re: root on ZFS <tomas@tuxteam.de> - 2018-09-12 09:50 +0200

csiph-web