Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #200786
| From | Celejar <celejar@gmail.com> |
|---|---|
| Newsgroups | linux.debian.user |
| Subject | Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? |
| Date | 2018-09-30 23:40 +0200 |
| Message-ID | <wDRBz-77I-99@gated-at.bofh.it> (permalink) |
| References | (10 earlier) <wClDH-1aa-1@gated-at.bofh.it> <wCznj-EB-1@gated-at.bofh.it> <wDyyR-42Q-5@gated-at.bofh.it> <wDDId-74r-3@gated-at.bofh.it> <wDGPL-Fd-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Sun, 30 Sep 2018 20:03:41 +1000 Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > Hi, > > On 30/09/18 16:44, deloptes wrote: > > Celejar wrote: > > > >> But grub itself and its configuration can't be encrypted, so an > >> attacker could still compromise that code / data. IIUC, your > >> solution basically just implies moving some of the logic > >> currently in the initramfs into grub. > > > > Yes, this is the point I am making. > > > >> One solution is to run grub from removable media, and preventing > >> attackers from getting physical access to it ... > > You can sometimes do remote mounting in something like HP's iLO .... > you could mount a floppy or ISO image and boot it with the image only > being available from a client machine using iLo. But it won't work > for machines without such capability. I actually do the equivalent using Dell's iDrac - I configure it (together with the machine's BIOS) to make the system console available over ssh (using iDrac ssh credentials), and then use that console to provide the credentials to unlock the system disk. IIUC, the security of this is equivalent to your method. Celejar
Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
ext2 for /boot ??? -- WAS: Re: root on ZFS Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-11 20:10 +0200
Re: ext2 for /boot ??? -- WAS: Re: root on ZFS Matthew Crews <mailinglists@mattcrews.com> - 2018-09-11 20:30 +0200
Re: ext2 for /boot ??? -- WAS: Re: root on ZFS Michael Stone <mstone@debian.org> - 2018-09-11 20:40 +0200
Re: ext2 for /boot ??? Felix Miata <mrmazda@earthlink.net> - 2018-09-12 01:40 +0200
Re: ext2 for /boot ??? Lee <ler762@gmail.com> - 2018-09-12 05:40 +0200
Re: ext2 for /boot ??? Mimiko <vbvbrj@gmail.com> - 2018-09-12 07:50 +0200
Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-12 11:20 +0200
Re: ext2 for /boot ??? Sven Joachim <svenjoac@gmx.de> - 2018-09-12 11:40 +0200
Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-09-12 21:00 +0200
Re: ext2 for /boot ??? Sven Joachim <svenjoac@gmx.de> - 2018-09-12 21:40 +0200
Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-12 23:00 +0200
Re: ext2 for /boot ??? Michael Stone <mstone@debian.org> - 2018-09-13 00:00 +0200
Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-09-14 05:30 +0200
Re: ext2 for /boot ??? Zenaan Harkness <zenaan@freedbms.net> - 2018-09-14 06:10 +0200
Re: ext2 for /boot ??? Stefan Monnier <monnier@iro.umontreal.ca> - 2018-09-14 14:40 +0200
Re: ext2 for /boot ??? Michael Stone <mstone@debian.org> - 2018-09-14 14:50 +0200
Re: ext2 for /boot ??? Matthew Crews <mailinglists@mattcrews.com> - 2018-09-14 17:10 +0200
Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-14 18:30 +0200
Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-14 20:00 +0200
Re: ext2 for /boot ??? Matthew Crews <mailinglists@mattcrews.com> - 2018-09-15 00:50 +0200
Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-15 08:50 +0200
Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-15 18:00 +0200
Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-16 00:00 +0200
Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andy Smith <andy@strugglers.net> - 2018-09-16 00:50 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-17 20:10 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-17 20:20 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-18 20:10 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andy Smith <andy@strugglers.net> - 2018-09-19 05:00 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-19 17:50 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Igor Cicimov <icicimov@gmail.com> - 2018-09-26 01:10 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-26 18:20 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-26 19:20 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-26 20:20 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-27 10:00 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-27 17:40 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Igor Cicimov <icicimov@gmail.com> - 2018-09-28 13:10 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Celejar <celejar@gmail.com> - 2018-09-30 03:20 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-30 08:50 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-09-30 12:10 +0200
Re: Decrypting LUKS from initramfs; was: Re: ext2 for /boot ??? Celejar <celejar@gmail.com> - 2018-09-30 23:40 +0200
Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-26 11:20 +0200
Re: ext2 for /boot ??? Dan Ritter <dsr@randomstring.org> - 2018-09-14 15:10 +0200
Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-14 20:50 +0200
Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-09-15 00:10 +0200
Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-15 09:20 +0200
Re: ext2 for /boot ??? Celejar <celejar@gmail.com> - 2018-09-16 16:40 +0200
Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-10-10 00:00 +0200
Re: ext2 for /boot ??? Zenaan Harkness <zenaan@freedbms.net> - 2018-09-15 01:30 +0200
Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-14 15:20 +0200
Re: ext2 for /boot ??? Brad Rogers <brad@fineby.me.uk> - 2018-09-14 16:50 +0200
Re: ext2 for /boot ??? Stefan Monnier <monnier@iro.umontreal.ca> - 2018-09-14 19:30 +0200
Re: ext2 for /boot ??? Michael Stone <mstone@debian.org> - 2018-09-14 22:20 +0200
Re: ext2 for /boot ??? Erik Christiansen <dvalin@internode.on.net> - 2018-09-15 08:50 +0200
Re: ext2 for /boot ??? Gene Heskett <gheskett@shentel.net> - 2018-09-15 10:10 +0200
The big, the bloated and the hungry (Was: ext2 for /boot ???) Étienne Mollier <etienne.mollier@mailoo.org> - 2018-09-15 10:20 +0200
Re: The big, the bloated and the hungry Felix Miata <mrmazda@earthlink.net> - 2018-09-15 10:50 +0200
Re: The big, the bloated and the hungry Étienne Mollier <etienne.mollier@mailoo.org> - 2018-09-15 11:30 +0200
Re: The big, the bloated and the hungry Celejar <celejar@gmail.com> - 2018-09-16 16:50 +0200
Re: The big, the bloated and the hungry Nicholas Geovanis <nickgeovanis@gmail.com> - 2018-09-18 19:00 +0200
Re: The big, the bloated and the hungry Étienne Mollier <etienne.mollier@mailoo.org> - 2018-09-18 21:10 +0200
Re: The big, the bloated and the hungry (Was: ext2 for /boot ???) Thakur Mahashaya <thmsh@yandex.ru> - 2018-09-15 12:50 +0200
Re: The big, the bloated and the hungry (Was: ext2 for /boot ???) Thakur Mahashaya <thmsh@yandex.ru> - 2018-09-15 12:50 +0200
Re: The big, the bloated and the hungry (Was: ext2 for /boot ???) Thakur Mahashaya <thmsh@yandex.ru> - 2018-09-15 13:00 +0200
Re: The big, the bloated and the hungry etienne.mollier@mailoo.org - 2018-09-16 12:20 +0200
Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-26 11:10 +0200
Re: ext2 for /boot ??? Stefan Monnier <monnier@iro.umontreal.ca> - 2018-09-14 14:50 +0200
Re: ext2 for /boot ??? Kenneth Parker <sea7kenp@gmail.com> - 2018-09-14 06:40 +0200
Re: ext2 for /boot ??? David Wright <deblis@lionunicorn.co.uk> - 2018-09-14 17:40 +0200
Re: ext2 for /boot ??? Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-09-14 21:00 +0200
Re: ext2 for /boot ??? Jonathan Dowland <jmtd@debian.org> - 2018-09-26 11:10 +0200
Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-12 08:10 +0200
Re: ext2 for /boot ??? Felix Miata <mrmazda@earthlink.net> - 2018-09-12 08:20 +0200
Re: ext2 for /boot ??? deloptes <deloptes@gmail.com> - 2018-09-12 09:00 +0200
Re: ext2 for /boot ??? Brad Rogers <brad@fineby.me.uk> - 2018-09-12 11:20 +0200
Re: ext2 for /boot ??? Felix Miata <mrmazda@earthlink.net> - 2018-09-12 12:30 +0200
Re: ext2 for /boot ??? Michael Stone <mstone@debian.org> - 2018-09-12 15:50 +0200
Re: ext2 for /boot ??? Glenn English <ghe2001@gmail.com> - 2018-09-12 17:40 +0200
Re: ext2 for /boot ??? Brad Rogers <brad@fineby.me.uk> - 2018-09-12 18:00 +0200
Re: ext2 for /boot ??? Felix Miata <mrmazda@earthlink.net> - 2018-09-12 18:30 +0200
Re: ext2 for /boot ??? -- WAS: Re: root on ZFS <tomas@tuxteam.de> - 2018-09-12 09:50 +0200
csiph-web