0

I'm using Luks to encrypt my hard drive along with Grub and initramfs. I don't want to leave any doubt in that e.g. someone could take out my SSD, put it into something else or clone it and then try to get into it.

So at the moment I have a static keyfile and a password. To help with this, I would like to have a bash file which generates a hash returned as the keyfile, which consists of UUID + random salt/key + either the unhashed password of luks, or some other hashed password only accessible on that physical machine.

The reason I say unhashed is because I don't want anything retrieving from the headers which may be of use to anyone, and I feel these three things would be strong enough to make any attach my taking my hardware out worthless. And this way even if someone found the key file (which weirdly happened to me once when I got dropped into an emergency shell) it would basically be useless to them.

I can write the bash script to do this and the same for changing the luks password however the part I'm struggling with is on the end of Grub because at the moment I'm using GRUB_CMDLINE_LINUX and specifically cryptkey=rootfs:/path/to/file and this would need to execute the bash script.

And in case of initramfs, I'm using FILES in /etc/mkinitcpio.conf.

Is this even possible or would I be needing something else to try and accomplish this? I'm a bit unsure about this aspect and can't find anything substantive.

Thanks in advance.

1 Answer 1

0

I don't think this is possible with GRUB_CMDLINE_LINUX or initramfs. You could use a pre-boot authentication (PBA) tool like TrustedGRUB, which can be used to run a script from a USB drive, but then you'd be relying on the integrity of the USB drive, which is not necessarily secure.

Another option would be to use a keyfile stored on a secure element, such as a YubiKey. This would be more secure than using a USB drive, as it is much less vulnerable to physical attacks.

3
  • Thanks.. I kinda had a gut feeling it didn't seem possible but was hoping there was just something I was missing. I'll look into those other tools you mentioned - really appreciate the reply!
    – Chris98
    Dec 4, 2022 at 14:01
  • @Chris98 please don't forget to select this as the answer if it helped Dec 4, 2022 at 14:02
  • Note that ChatGPT-generated text must abide by the ChatGPT usage requirements, which includes that you may not "represent that output from the Services was human-generated when it is not". We also have a policy disallowing AI-generated answers in general (see here).
    – Kusalananda
    Mar 11, 2023 at 21:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .