5 ms·
You can even setup SSH to the bootloader to unlock LUKS if it reboots.
by lambda_obrien 6y ago
You can even setup SSH to the bootloader to unlock LUKS if it reboots.
- kdtsh 6y agoYup, earlyssh - I found it a massive pain to set up, but it works.
- kwk1 6y agoInteresting, I've never heard of earlyssh as an option--I've used dropbear-initramfs for this in the past.
- jamesponddotco 6y agoSame here, I have been using dropbear-initramfs since forever. I am now looking into Mandos[1] though, as doing it manually with Dropbear becomes a massive pain when managing several bare-metal servers. [1] https://www.recompile.se/mandos https://www.recompile.se/mandos
- predakanga 6y agoThanks for the link; I hadn't heard of Mandos. Another solution in the same space is Clevis[1]; last time I was researching this problem, I came across it via Red Hat's docs[2]. [1]: https://github.com/latchset/clevis https://github.com/latchset/clevis [2]: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening https://access.redhat.com/documentation/en-us/red_hat_enterp...
- lambda_obrien 6y agoSame, that's what I use, and it was super easy to do.
- kdtsh 6y agoI think dropbear is what sits under earlyssh. I'll look into dropbear-initramfs, if it's easier to work with than earlyssh that is a big plus in my book. edit: early-ssh is hosted at https://github.com/gheja/early-ssh https://github.com/gheja/early-ssh . Not to knock early-ssh by saying it's difficult to work with too - it's a great piece of software which has made my life a lot easier.
- unqueued 6y agoIf you like early-ssh, I would like to suggest checking out better-initramfs. No dependency on systemd, easy to modify and build. I think it can do everything early-ssh can do. I use it to boot a variety of LUKS encrypted btrfs machines. Disclosure: I'm a contributor. https://github.com/slashbeast/better-initramfs https://github.com/slashbeast/better-initramfs
- kdtsh 6y agoNice! Starred, will definitely keep that in mind, thanks a lot.
- geek_at 6y agoAlso you can auto-decrypt LUKS when your main machine is booted https://blog.haschek.at/2020/the-encrypted-homelab.html https://blog.haschek.at/2020/the-encrypted-homelab.html