Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[solved] dmcrypt with a usb key (no fs)
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
vokiel
n00b
n00b


Joined: 01 Oct 2004
Posts: 69

PostPosted: Fri Aug 18, 2017 3:39 am    Post subject: [solved] dmcrypt with a usb key (no fs) Reply with quote

I'm basically trying to replicate this scenario: https://stackoverflow.com/questions/19713918/how-to-load-luks-passphrase-from-usb-falling-back-to-keyboard

- Unpartitioned usb key with no fs
- Some randomly generated key copied at some offset with some length
- Use this at boot time to unlock the home partition.

Not sure if the crypttab setup can be done in dmcrypt or if it's sane at all.

Any insights welcome, thank you.


Last edited by vokiel on Sun Aug 20, 2017 6:36 pm; edited 1 time in total
Back to top
View user's profile Send private message
tberger2
n00b
n00b


Joined: 05 Feb 2013
Posts: 69

PostPosted: Sun Aug 20, 2017 9:17 am    Post subject: Reply with quote

My server has an unencrypted system partition. Decryption of home or other partions can done a) manually or b) by inserting a prepared usb device using an udev rule which starts a decryption script. Once decrypted the server provides a nfs share distributing a key file. This key file is needed to decrypt e.g. my notebook computer which is fully encrypted. Decryption is accomplished by a custom initramfs (UEFI boot).

This is the most usefull way for me.

--- edit ---
Don't forget: Using such an usb device is a comfort feature, definitely NOT a security feature!
Back to top
View user's profile Send private message
vokiel
n00b
n00b


Joined: 01 Oct 2004
Posts: 69

PostPosted: Sun Aug 20, 2017 6:36 pm    Post subject: Reply with quote

In /etc/conf.d/dmcrypt

Code:
target=crypt-home
source='/dev/nvme0n1p10'
key='/dev/disk/by-id/<ID>:reg'
options='--keyfile-offset=<OFFSET> --keyfile-size=<SIZE>'


Works well for me.

I agree this is just for convenience, it makes the setup less secure. You have to think about pulling the key when leaving the laptop. I'll look into having some custom udev rules for when I do this, that's a good idea.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum