I log in to a server via public key authentication and then mount a container (using e.g. LUKS/dm-crypt or truecrypt). At the moment, I have to enter the container password manually. Is there a way to secure that container using e.g. the ssh agent? Or if that is not possible directly, can I encrypt the container password (or probably better, keyfile) with the ssh public key and use ssh agent to decrypt it temporarily?
1 Answer
I did something similar to this once with a remote encfs where I stored backups from my local PC. Maybe this will help. I was using Ubuntu with gnome-keyring at the time.
dbus_session.sh
#!/bin/bash
# This will grab the appropriate environment variables to connect to the
# gnome-keyring via dbus for the currently logged in user
# shouldn't be necessary if you're running from an xterm in gnome
$(sed 's/^\([^#]\)/export \1/' ~/.dbus/session-bus/*-0 | grep -v ^#)
keyring_helper.py
#!/usr/bin/python
import sys
import keyring
if len(sys.argv) < 5:
print "Usage: keyring_helper.py get|set name server protocol [password]"
sys.exit(1)
k = keyring.Keyring(sys.argv[2], sys.argv[3], sys.argv[4])
if sys.argv[1] == "get":
c = k.get_credentials()
print c[1]
elif sys.argv[1] == "set":
k.set_credentials((sys.argv[2], sys.argv[5]));
backup.sh
#!/bin/bash
. "$(dirname "$0")"/dbus_session.sh
cd /home/mike/misc/scripts
if ssh polaris mountpoint -q ~/mnt/; then
echo 1>&2 Filesystem already mounted.
exit 1
fi
# Take password from gnome-keyring and store in FIFO on polaris
./keyring_helper.py get mike polaris enc_backups 2>/dev/null |ssh polaris 'cat >~/passwd' &
# Mount the encrypted filesystem
ssh polaris 'nice -n 19 encfs -f -i 5 --extpass=cat ~/enc_backups/ ~/mnt/ <~/passwd' &
# Wait for the mount to complete
ssh polaris 'while ! mountpoint -q ~/mnt/; do if [ $((I++)) -gt 15 ]; then exit 1; fi; sleep 1; done'
if [ $? -ne 0 ]; then
echo 1>&2 Mount failed.
exit 2
fi
# Transfer data
rsync -az --delete --bwlimit 45 ~/misc /array/Dropbox/documents /array/pictures polaris:mnt/
# Unmount the encrypted filesystem
ssh polaris fusermount -u mnt
# Wait for child processes to exit
wait
The initial setup is pretty simple, do a mkfifo passwd
on your remote server and keyring_helper.py set <name> <server> <protocol>
on your desktop. Once that's complete, your desktop should write your password from the keyring to the fifo where a remote truecrypt process will read it via stdin.
-
1
ssh-agent
signed message as a password secure?