How to decrypt an encrypted container via ssh without entering a passphrase while requiring some client authentication?

Question

I log in to a server via public key authentication and then mount a container (using e.g. LUKS/dm-crypt or truecrypt). At the moment, I have to enter the container password manually. Is there a way to secure that container using e.g. the ssh agent? Or if that is not possible directly, can I encrypt the container password (or probably better, keyfile) with the ssh public key and use ssh agent to decrypt it temporarily?

Answer 1

I did something similar to this once with a remote encfs where I stored backups from my local PC. Maybe this will help. I was using Ubuntu with gnome-keyring at the time.

dbus_session.sh

#!/bin/bash
# This will grab the appropriate environment variables to connect to the 
# gnome-keyring via dbus for the currently logged in user
# shouldn't be necessary if you're running from an xterm in gnome
$(sed 's/^\([^#]\)/export \1/' ~/.dbus/session-bus/*-0 | grep -v ^#)

keyring_helper.py

#!/usr/bin/python
import sys
import keyring

if len(sys.argv) < 5:
        print "Usage: keyring_helper.py get|set name server protocol [password]"
        sys.exit(1)

k = keyring.Keyring(sys.argv[2], sys.argv[3], sys.argv[4])

        if sys.argv[1] == "get":
                c = k.get_credentials()
                print c[1]
elif sys.argv[1] == "set":
        k.set_credentials((sys.argv[2], sys.argv[5]));

keyring.py

backup.sh

#!/bin/bash
. "$(dirname "$0")"/dbus_session.sh
cd /home/mike/misc/scripts

if ssh polaris mountpoint -q ~/mnt/; then
  echo 1>&2 Filesystem already mounted.
  exit 1
fi

# Take password from gnome-keyring and store in FIFO on polaris
./keyring_helper.py get mike polaris enc_backups 2>/dev/null |ssh polaris 'cat >~/passwd' &

# Mount the encrypted filesystem
ssh polaris 'nice -n 19 encfs -f -i 5 --extpass=cat ~/enc_backups/ ~/mnt/ <~/passwd' &

# Wait for the mount to complete
ssh polaris 'while ! mountpoint -q ~/mnt/; do if [ $((I++)) -gt 15 ]; then exit 1; fi; sleep 1; done'

if [ $? -ne 0 ]; then
  echo 1>&2 Mount failed.
  exit 2
fi

# Transfer data
rsync -az --delete --bwlimit 45 ~/misc /array/Dropbox/documents /array/pictures polaris:mnt/

# Unmount the encrypted filesystem
ssh polaris fusermount -u mnt

# Wait for child processes to exit
wait

The initial setup is pretty simple, do a mkfifo passwd on your remote server and keyring_helper.py set <name> <server> <protocol> on your desktop. Once that's complete, your desktop should write your password from the keyring to the fifo where a remote truecrypt process will read it via stdin.