18

I have a fairly standard disk encryption setup in Debian 5.0.5: unencrypted /boot partition, and encrypted sdaX_crypt that contains all other partitions.

Now, this is a headless server installation and I want to be able to boot it without a keyboard (right now I can boot it only with a keyboard and a monitor attached).

So far I have an idea of moving /boot partition to an USB drive and make slight modifications to auto-enter the key (I think there is just a call to askpass in the boot script somewhere). This way I can boot headless, just need to have a flash drive in at boot time.

As I see it, the problem with it is that

  1. I need to invest time into figuring out all bits and pieces to make it work,
  2. If there is an update, which regenerates initrd, I need to regenerate the boot partition on the USB, which seems tedious.

The question: is there a standard low-upkeep solution available for what I want to do? Or should I be looking elsewhere altogether?

Improve this question

3 Answers 3

Reset to default
7

You can setup your system to require a key instead of a password and change some scripts to search for this key on a USB stick. I found a detailed explanation for this process on Debian Lenny. There are some notes in the end that describe necessary changes for newer versions of Debian.

Improve this answer
2
  • Sounds like what I need. I first need to see how much effort it is to keep things working between updates before I accept the answer.
    – Alex B
    Commented Aug 21, 2010 at 11:34
  • OK, though there isn't a "standard" solution, this seems to have worked.
    – Alex B
    Commented Aug 22, 2010 at 11:41
5

But then what is the point of having full disk encryption, if you're just leaving the keys laying around in plaintext?

For that to work, you'd need something like what the Trusted Computing Platform was supposed to be before Microsoft and Big Media hijacked it for their own evil user-subduing purposes.

The idea is have a chip holding the keys in the motherboard, and having it give the keys only when it's verified that the software running was properly signed by a trusted authority (you). This way you don't leave the keys in plain sight and you don't have to boot the server interactively.

It's a pity I've never seen Trusted Computing put to any good use, which could actually be useful for the end user.

Improve this answer
6
  • The key is no more laying around in plaintext than your SSH key laying around in plaintext in ~/.ssh. I just want to be able to boot a headless server with full disk encryption and take the key out. I realize that attacker can modify the unencrypted boot partition and steal the key (like with a software-based regular password version anyway), but I'm just protecting against casual theft.
    – Alex B
    Commented Mar 28, 2011 at 3:33
  • Actually the TPM has come back away from DRM and to government and enterprises uses lately. There are plenty of OSes that can use it to store secret keys, I don't know of any that offers integrity protection (i.e. not allowing an attacker to insert a keylogger in /boot).
    – Gilles 'SO- stop being evil'
    Commented Mar 28, 2011 at 7:21
  • @AlexB: Does your server have a TPM? If so, you can probably do what you want with Trusted Grub.
    – Gilles 'SO- stop being evil'
    Commented Mar 28, 2011 at 7:22
  • Note that there is a benefit of leaving keys in plaintext, which would be that you could completely wipe sensitive data on a disk without zeroing out the whole disk. Yes, you could zero out the superblock or the partition table, but as we all know, data is still recoverable from those operations.
    – strugee
    Commented Aug 28, 2013 at 20:57
  • @strugee: if you're using LUKS, zeroing out the LUKS header makes the entire volume unrecoverable. If your using plain headerless dm-crypt, then yes, it is still recoverable later on with a password.
    – Jay Sullivan
    Commented Jan 31, 2015 at 20:22
5

Mandos (which I and others have written) solves this very problem:

Mandos is a system for allowing servers with encrypted root file systems to reboot unattended and/or remotely. See the intro manual page for more information, including an FAQ list.

In short, the booting server gets the password over the network, in a secure fashion. See the README for details.

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .