Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I log in to a server via public key authentication and then mount a container (using e.g. LUKS/dm-crypt or truecrypt). At the moment, I have to enter the container password manually. Is there a way to secure that container using e.g. the ssh agent? Or if that is not possible directly, can I encrypt the container password (or probably better, keyfile) with the ssh public key and use ssh agent to decrypt it temporarily?

share|improve this question
1  

1 Answer 1

I did something similar to this once with a remote encfs where I stored backups from my local PC. Maybe this will help. I was using Ubuntu with gnome-keyring at the time.

dbus_session.sh

#!/bin/bash
# This will grab the appropriate environment variables to connect to the 
# gnome-keyring via dbus for the currently logged in user
# shouldn't be necessary if you're running from an xterm in gnome
$(sed 's/^\([^#]\)/export \1/' ~/.dbus/session-bus/*-0 | grep -v ^#)

keyring_helper.py

#!/usr/bin/python
import sys
import keyring

if len(sys.argv) < 5:
        print "Usage: keyring_helper.py get|set name server protocol [password]"
        sys.exit(1)

k = keyring.Keyring(sys.argv[2], sys.argv[3], sys.argv[4])

        if sys.argv[1] == "get":
                c = k.get_credentials()
                print c[1]
elif sys.argv[1] == "set":
        k.set_credentials((sys.argv[2], sys.argv[5]));

keyring.py

backup.sh

#!/bin/bash
. "$(dirname "$0")"/dbus_session.sh
cd /home/mike/misc/scripts

if ssh polaris mountpoint -q ~/mnt/; then
  echo 1>&2 Filesystem already mounted.
  exit 1
fi

# Take password from gnome-keyring and store in FIFO on polaris
./keyring_helper.py get mike polaris enc_backups 2>/dev/null |ssh polaris 'cat >~/passwd' &

# Mount the encrypted filesystem
ssh polaris 'nice -n 19 encfs -f -i 5 --extpass=cat ~/enc_backups/ ~/mnt/ <~/passwd' &

# Wait for the mount to complete
ssh polaris 'while ! mountpoint -q ~/mnt/; do if [ $((I++)) -gt 15 ]; then exit 1; fi; sleep 1; done'

if [ $? -ne 0 ]; then
  echo 1>&2 Mount failed.
  exit 2
fi

# Transfer data
rsync -az --delete --bwlimit 45 ~/misc /array/Dropbox/documents /array/pictures polaris:mnt/

# Unmount the encrypted filesystem
ssh polaris fusermount -u mnt

# Wait for child processes to exit
wait

The initial setup is pretty simple, do a mkfifo passwd on your remote server and keyring_helper.py set <name> <server> <protocol> on your desktop. Once that's complete, your desktop should write your password from the keyring to the fifo where a remote truecrypt process will read it via stdin.

share|improve this answer
    
Hey thanks, I'll try and give it a shot –  Tobias Kienzler Oct 11 '12 at 5:59
1  
Interesting. Remember to chmod 600 passwd. –  peterph Oct 6 '13 at 20:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.