| View previous topic :: View next topic |
| Author |
Message |
CaptainBlood
Advocate
Joined: 24 Jan 2010
Posts: 3625
|
 Posted: Thu Jun 18, 2015 5:41 am Post subject: How 2 crypt partition according 2 local HW id (mac/serial) |
 |
|
Hi,
May the idea is truly silly, but I have an idea to crypt a partition with embedded key.
Just to avoid pure cloning of a partition system to work on a identical second hw platform.
Any comment about the idea?
Has any one achieved such a customization?
Thks 4 ur attention, interest & support.[/u] |
|
| Back to top |
|
 |
frostschutz
Advocate
Joined: 22 Feb 2005
Posts: 2977
Location: Germany
|
| Posted: Thu Jun 18, 2015 7:05 am Post subject: |
|
|
Encryption key based on cpu, ram, mac address, static random file (salt), ...:
https://wiki.gentoo.org/wiki/Custom_Initramfs/Examples#Self-Decrypting_Server
You'd have to adapt it to your own needs though. Especially the /proc/meminfo is rather noisy (changes with every kernel compile).
Definitely have a backup passphrase if you use this.
Also note that obtaining mac address in early initramfs requires for the network driver to be builtin (or have the initramfs load the network module first). |
|
| Back to top |
|
|
szatox
Advocate
Joined: 27 Aug 2013
Posts: 3135
|
| Posted: Thu Jun 18, 2015 8:18 pm Post subject: |
|
|
I wonder, what is the purpose of such a setup? Replacing cheap central heating with high-tech CPU-based?
I mean, sure you can do for example
lspci -n | sha256sum
240e4eda61dfcae171d5b05a19f99acdf370ac6df28d1d8a6e9b247268573e1a -
but encrypted storage is ment to guard agains people with physical access to your toys. And this way someone with physical access has the key as well. So... Encrypted backup on external hard drive?
| Quote: | | Just to avoid pure cloning of a partition system to work on a identical second hw platform. |
With user-defined password you can just move the drive. Would you rather recrypt it? |
|
| Back to top |
|
|
frostschutz
Advocate
Joined: 22 Feb 2005
Posts: 2977
Location: Germany
|
| Posted: Thu Jun 18, 2015 8:34 pm Post subject: |
|
|
| szatox wrote: | | but encrypted storage is ment to guard agains people with physical access to your toys. |
There's physical access and there's physical access.
You can walk along a rack, pop HDDs out and take them with you. Easy-peasy.
Or your datacenter pops them out when they start growing bad sectors. What they do with it then is their affair. I have a datacenter I trust completely but even there people work and people make mistakes, there was one case where a customer got the HDD of another customer along with their data.
| szatox wrote: | | And this way someone with physical access has the key as well. |
Only true if they know a lot more detail about the box they popped the HDD out of and hopefully you have enough variables to make bruteforce unattractive. |
|
| Back to top |
|
|
CaptainBlood
Advocate
Joined: 24 Jan 2010
Posts: 3625
|
| Posted: Fri Jun 19, 2015 8:13 pm Post subject: |
|
|
Let say I want to set up an solution on arm PI and sell it.
People could try to make a copy of SD card in order to clone, install in identical HW, customize and sell behind my back.
I know what I suggest is not a strong protection, but at least they would be some.
I guess it is not so hard to reset root pwd on an offline system partition.
I just want to discourage gready noobs at first level. No it is not easy as what they expected... |
|
| Back to top |
|
|
CaptainBlood
Advocate
Joined: 24 Jan 2010
Posts: 3625
|
| Posted: Fri Jun 19, 2015 8:30 pm Post subject: |
|
|
| frostschutz wrote: | Encryption key based on cpu, ram, mac address, static random file (salt), ...:
https://wiki.gentoo.org/wiki/Custom_Initramfs/Examples#Self-Decrypting_Server
Mac adress or MotherBoard Serial
You'd have to adapt it to your own needs though. Especially the /proc/meminfo is rather noisy (changes with every kernel compile).
Definitely have a backup passphrase if you use this.
Also note that obtaining mac address in early initramfs requires for the network driver to be builtin (or have the initramfs load the network module first). |
Mac adress or MotherBoard Serial N° were just an example of something that may be unique to a specific platform.
Dongle key could also be the expensive way to see it...
Thanks for the link, as you saved my day... I was to early in the process to get there. Never encrypted any partition yet.
Thks 4 ur attention, interest & support |
|
| Back to top |
|
|
|
Other Things Gentoo
