I'm setting up a new Debian Stretch installation, and it's all a bit new to me. I've used linux a lot, but I've never really been an administrator of a server before. Because this system, or some services on it at least, will be visible to the outside world I would like to secure it as much as possible. Visible in both the "internet" sense as well as you know.. I don't live in a bank vault, so it's entirely imaginable that someone could simply burgle my home.

The box has a USB memory "welded" into the motherboard, 512mb in size. I was thinking to put the /boot partition there, while everything else would live on a RAID1 array with 2x4tb drives encrypted with LUKS and with LVM on top to take care of partitioning. It all looks like like a reasonably good idea to me, but I was looking for a way to avoid having to type in the encryption password every time the system reboots. So the obvious problem is how to store that password or key without compromising the whole setup.

The idea, and it looks to me like it's not a new one, is to put the key on a USB stick (a.k.a. USB key) that would be required to be physically inserted into one of the usb slots in the server in order to mount the encrypted drives. I even found a way to increase the level of security without having to encrypt the usb key (which would then require me to type a password in for that) by filling up the usb key with random data and no file system, mounting it as a block device and using an arbitrary subset of it's random garbage as key. All fine, but I'm kinda lost as to where to start.

1) How do I force Debian to attempt to mount a usb stick prior to trying to mount the encrypted drives? I can probably write a shell script that will mount the memory as block device, read whatever needs to be read from it, unmount it and then use the data read to mount the encrypted drives. But where do I plug it in?

2) Can I make the boot stop and wait (indefinitely or maybe give up and shut down after a certain period of time) until a usb key with the right data is presented? Or will it all just continue to boot without anything but /boot partition and fail miserably?

3) Can I make it so that I only ever need the usb key at boot time, but after the encrypted FS is mounted the usb key can be safely removed (till the next reboot of course) without having to type a single command into the terminal?

  • the keyscript=passdev option in crypttab will take care of most of what you want (passdev is a program, and needs its own options in the key file field). I don't feel like giving an answer because there's a lot of trial and error to do, so my answer would probably not work as is. – A.B Mar 16 at 23:24
  • 1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.