Comment - FBXL Lotide

Comment on Unlocking LUKS with NitroKey/Yubikey: FIDO2, HMAC-SHA1, or OpenPGP?

talkingpumpkin@lemmy.world ⁨1⁩ ⁨day⁩ ago

If it’s a server for self hosting you definitely don’t want anything that requires interaction at boot.

There’s a project that allows unlocking LUKS with a decryption key retrieved from another machine in your network. I don’t recall the name but someone hopefully will.

The idea is that put the key on, say, a raspberry pi zero w that you hide somewhere in your house so that if someone steals your server they don’t have the key.

original

Sort:hotnew top

percent@infosec.pub ⁨17⁩ ⁨hours⁩ ago
My servers require manual unlock via SSH at boot. It has been great for years.

original
JustEnoughDucks@slrpnk.net ⁨1⁩ ⁨day⁩ ago
Some people are fine with down time/inconvenience in exchange for security.

I have my boot drive on a secured USB and LUKS keyfile with the rest of the partitions on an encrypted SSD and data on encrypted HDDs.

In a smash and grab (or fascist government gestapo smash and grab), the server is pretty impossible to steal information from (inject illegal content to in order to fabricate evidence) without the USB and they can’t simply inject boot malware either. A network device is almost always findable either by cables or WiFi broadcast analyzing.

original
modem_down@thebrainbin.org ⁨1⁩ ⁨day⁩ ago

If it's a server for self hosting you definitely don't want anything that requires interaction at boot.

That depends. If you only plan to boot it when you're physically present, then it's fine.

original
esc@piefed.social@piefed.social ⁨1⁩ ⁨day⁩ ago
tang

original
- modem_down@thebrainbin.org ⁨1⁩ ⁨day⁩ ago
  
  tang
  
  Thanks. TIL about Clevis/Tang.
  
  original
superglue@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago
I haven’t actually tried it yet, but on that note, if you have an OpenWRT router you can configure dropbear to unlock it.

original