Comment on Encrypting without full disk encryption question
lorentz@feddit.it 21 hours agoI’ve configured something similar. The /boot partition is the only unencrypted. In the initramfs there is a script that downloads half of the decryption key from http, while the other half is stored in the script itself. The script implements automated retry until it can fetch the key and decrypt the root partition.
My attack model here is that, as soon as I realize someone stole my NAS I can shutdown the server hosting half of the decryption key making my data safe. There is a window where the attacker could connect it to a network and decrypt the data, but it is made more difficult by the static network configuration: they should have a default gateway with the same IP address of mine.
On my TODO list I also have to implement some sort of notification to get an alert when the decryption key is fetched from internet.
Passerby6497@lemmy.world 16 hours ago
Why is it fetchable by arbitrary IPs from the internet? I’d think you’d lock it down to an IP/only make it available locally.
lorentz@feddit.it 13 hours ago
The decryption key is more than 20 random character, so if you get only half of it is not a biggie and it doesn’t look like anything interesting.
It is on the internet mostly because I don’t have anything else to host it locally. But I see some benefit: I wanted for the server to be available immediately after a power failure. If it fetches the key from internet I just need for the router to be online, if it fetches it from the local network I need another server running unencrypted disk.
shroomato@lemmy.world 3 hours ago
Most cloud providers have some kind of firewall that allows to configure a resource being accessible only from certain IP addresses. Worth it to set to your home IP address, as long as it’s static.