Comment on Encrypting without full disk encryption question
I2jgwh0hYtxrCZQ@lemmy.sdf.org 1 day ago
I read somewhere someone had their encryption key on their phone / another server and had the server pull the key via ftp on boot. Then the server and encryption key is separated but can decrypt its self as long on the ftp server is available.
lorentz@feddit.it 1 day ago
I’ve configured something similar. The /boot partition is the only unencrypted. In the initramfs there is a script that downloads half of the decryption key from http, while the other half is stored in the script itself. The script implements automated retry until it can fetch the key and decrypt the root partition.
My attack model here is that, as soon as I realize someone stole my NAS I can shutdown the server hosting half of the decryption key making my data safe. There is a window where the attacker could connect it to a network and decrypt the data, but it is made more difficult by the static network configuration: they should have a default gateway with the same IP address of mine.
On my TODO list I also have to implement some sort of notification to get an alert when the decryption key is fetched from internet.
Passerby6497@lemmy.world 22 hours ago
Why is it fetchable by arbitrary IPs from the internet? I’d think you’d lock it down to an IP/only make it available locally.
lorentz@feddit.it 19 hours ago
The decryption key is more than 20 random character, so if you get only half of it is not a biggie and it doesn’t look like anything interesting.
It is on the internet mostly because I don’t have anything else to host it locally. But I see some benefit: I wanted for the server to be available immediately after a power failure. If it fetches the key from internet I just need for the router to be online, if it fetches it from the local network I need another server running unencrypted disk.
shroomato@lemmy.world 9 hours ago
Most cloud providers have some kind of firewall that allows to configure a resource being accessible only from certain IP addresses. Worth it to set to your home IP address, as long as it’s static.