From owner-freebsd-security@FreeBSD.ORG  Thu Sep  7 07:21:32 2006
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
X-Original-To: freebsd-security@freebsd.org
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id ADA1D16A503;
	Thu,  7 Sep 2006 07:21:32 +0000 (UTC)
	(envelope-from nvass@teledomenet.gr)
Received: from matrix.teledomenet.gr (dns1.teledomenet.gr [213.142.128.1])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 2C96343D5C;
	Thu,  7 Sep 2006 07:21:29 +0000 (GMT)
	(envelope-from nvass@teledomenet.gr)
Received: from iris ([192.168.1.71])
	by matrix.teledomenet.gr (8.12.10/8.12.10) with ESMTP id k877LREY025029;
	Thu, 7 Sep 2006 10:21:27 +0300
From: Nikos Vassiliadis <nvass@teledomenet.gr>
To: freebsd-questions@freebsd.org
Date: Thu, 7 Sep 2006 10:19:46 +0300
User-Agent: KMail/1.9.1
References: <20060906210021.C2428B82C@shodan.nognu.de>
In-Reply-To: <20060906210021.C2428B82C@shodan.nognu.de>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200609071019.46529.nvass@teledomenet.gr>
X-Mailman-Approved-At: Thu, 07 Sep 2006 12:08:50 +0000
Cc: freebsd-security@freebsd.org, Frank Steinborn <steinex@nognu.de>
Subject: Re: Getting GELI Keys from Floppy
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 07 Sep 2006 07:21:32 -0000

On Thursday 07 September 2006 00:00, Frank Steinborn wrote:
> Hello,
>
> i want to encrypt my HDD's with GELI (not the root-fs, though). I want
> to do the encryption without password, just with a key. The key should
> be stored in a floppy disk, and the read should be read automatically
> on boot, from the floppy.

Are you sure you want to trust a floppy disk for your keys??
It's not the most safe medium these days...

>
> There is a problem here, because GELI initializes _before_ mounting
> the disks from /etc/fstab (for obvious reasons, of course). So GELI is
> not able to get the keys from the floppy and fails.
>
> So, any hints how I could get the floppy mounted _before_ GELI tries
> to initialize?

Why don't you use the plain device(/dev/fd0) instead of using a file on a 
filesystem on the floppy? I think there are examples in the manual page.

Anyway, I find this a very very bad idea. If the floppy break in some way
you're gonna be in big trouble...