I've my headless linux box configured with a serial console. /etc/default/grub:

GRUB_CMDLINE_LINUX="console=tty0 console=ttyS0,115200"
GRUB_TERMINAL="console serial"
GRUB_SERIAL_COMMAND="serial --unit=0 --speed=115200"

Now....I would like to encrypt the serial console. My goal is to make the serial console available only to specific terminal devices (i.e. laptop with specific encryption key).

  1. Is there a tool/terminal emulator that will do it already?

  2. Is there a way to configure grub to encrypt the serial output (or pipe thru an user specified encryption application) before sending to the COM1?

I'm not in need for a public-private key exchange mechanism. For a start, simply pre-configuring both end of the link with a private encryption key will suffice.

  • 1
    I'm not aware of any tooling that meets this requirement. Typically in an enterprise with serial consoles you have a terminal server, and ssh to the server so network traffic is encrypted. Enforcing encryption on the serial port itself (eg for IoT devices) is not something I've heard of. Grub can't filter through a user process because it runs before the kernel has even started. Sep 5, 2020 at 2:18

1 Answer 1


with hardware

This cannot be done in software, because you have specified that you need encryption of serial port traffic even before an operating system has been bootstrapped, as well as encryption of the kernel console I/O (not just the application /dev/console I/O).

Essentially, one has two boxes, one directly connected to the remote machine and one directly connected to the laptop, and the leg of the serial communication between the two boxes is what is encrypted.

There are various vendors of hardware that can do this. The SSE-R Serial Data Encrypter from DCB is just a randomly chosen example of one such. See §1 of its user manual for diagrams and §5 for how one inputs a shared secret at both ends.

One can also buy encrypting modems. Again, the SM-56 Encrypted Security Dial-up Modem from Arc Electronics is just a randomly chosen example of one such. But by the looks of your question you will not be using modems and the PSTN between your machines.

This sort of thing is common in the remote data collection/control world, and the literature of the field will prove informative. Note that this relies upon physical security; because otherwise an attacker can un-plug the encryption boxes, or nick the one from the laptop.

One can also tunnel such serial traffic over Ethernet, and IP, using a "terminal server" a.k.a. "serial server", which is again a separate piece of hardware. (Again, "virtual serial ports" in software are precluded by your requirement for doing this before an operating system is bootstrapped.) But there's no indication in your question that you intend remote access via a LAN/WAN.

I'm treating as beyond the scope of this answer one then starting to get serious and entering the world of remote out-of-band (a.k.a. "lights-out") management. ☺

Further reading

  • William T. Shaw (2006). "Electronic/System Security". Cybersecurity for SCADA Systems. PennWell Books. ISBN 9781593700683.
  • Ann Beheler (1999). Introduction to Data Communications Using Novell NetWare (4.11). Prentice Hall. ISBN 9780132705707.
  • Jonathan de Boyne Pollard (2018). "linux-console". Devices. nosh toolset.
  • Thanks for the detailed answer. But as you noted, this requires physical security which is something I cannot guarantee. Indeed, this is exactly the problem I'm trying to fix by encrypting the serial console before it leaves the linux box.
    – codechimp
    Sep 6, 2020 at 2:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .