Submitted 10 hours ago by modem_down@thebrainbin.org to selfhosted@lemmy.world
Crossposted from https://thebrainbin.org/m/linux@lemmy.ml/t/1840283
Which approach do you think is better, and why?
Or do you think there is an even better way to use a hardware security token to unlock drives having LUKS full disk encryption?
irmadlad@lemmy.world 8 hours ago I just manually type the password in. Not quit as elegant, but does the job.
irmadlad@lemmy.world 5 hours ago Is there a down vote bot loose on Lemmy? Weirdness.
FIDO2 is great. Only thing I am scared of is losing it/them. So a backup access becomes the issue IMHO.
Does this have anything to do with self hosting?
Yes. Here are 3 common self-hosting scenarios:
For all three, FDE is a sensible precaution to protect the data in case the server is physically stolen.
Linux is probably the most common OS kernel for self-hosting. On that kernel, [LUKS (Linux Unified Key Setup)](Linux Unified Key Setup) is probably the most sensible FDE system to use. It's mature and reliable. But anyone self-hosting a Linux server with LUKS FDE is faced with the question of where to store the keys.
Hardware security tokens (HSTs) are widely considered a safer place for keys than SSDs, HDDs, or USB storage. They follow the smartcard principle: a private key can be written to an HST but not read from it (security vulnerabilities excepted. Instead, they implement cryptographic algorithms to prove possession of the private key. So, anyone self-hosting a Linux server with LUKS FDE should strongly consider storing their private key(s) on an HST.
However, there is more than one way to do that. Hence the question in my OP.
glizzyguzzler@piefed.blahaj.zone 1 hour ago
Interested in what you divine, I’m switching from a USB drive with the key in it to one of those fancy things.