From owner-freebsd-security@FreeBSD.ORG Thu Sep 7 15:29:17 2006 Return-Path: X-Original-To: freebsd-security@freebsd.org Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9268816A4DE for ; Thu, 7 Sep 2006 15:29:17 +0000 (UTC) (envelope-from jackbarnett@gmail.com) Received: from py-out-1112.google.com (py-out-1112.google.com [64.233.166.181]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5EC6243D6B for ; Thu, 7 Sep 2006 15:29:05 +0000 (GMT) (envelope-from jackbarnett@gmail.com) Received: by py-out-1112.google.com with SMTP id o67so356531pye for ; Thu, 07 Sep 2006 08:29:04 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; b=DeP/AFPN/iWidpT0PJZFPj0C5XkKGl5j1gtK+QvwKO3lqV4YSnAhX4LSQnK+9/rKhYCt31QtE6vgEmeBBhSWDBSZUoaBZBfNlLdb4T9+xqLjHKVEOMlfuztuwYN9JZCgTKW/lVY1wqaOxawbjZHdisn26x8e8geKB3zQJsdNl44= Received: by 10.35.115.18 with SMTP id s18mr890226pym; Thu, 07 Sep 2006 08:29:03 -0700 (PDT) Received: by 10.35.32.20 with HTTP; Thu, 7 Sep 2006 08:29:03 -0700 (PDT) Message-ID: Date: Thu, 7 Sep 2006 10:29:03 -0500 From: "Jack Barnett" To: freebsd-security@freebsd.org In-Reply-To: <54db43990609070759u25e58d28t8d08c52c9df3c765@mail.gmail.com> MIME-Version: 1.0 References: <20060906210021.C2428B82C@shodan.nognu.de> <20060906151041.N37483@3jane.math.ualberta.ca> <54db43990609070759u25e58d28t8d08c52c9df3c765@mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: Frank Steinborn Subject: Re: Getting GELI Keys from Floppy X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Sep 2006 15:29:17 -0000 That's a really good idea. - Removable media with key (so you can take it out for security reasons) and using a key so don't have to type in a passphrase each time. btw, is there any good document on GELI? One idea is having 1 server with a CD-ROM drive and exporting it via NFS. When a server boots it mounts the remote CD-ROM drive and looks for key "$HOSTNAME.key". CDs are reliable - hold a good amount of data (enough for lots of keys) and can be removed and taken with you. -J On 9/7/06, Bob Johnson wrote: > > On 9/6/06, Barkley Vowk wrote: > > You are a complete madman. You want to protect your data with a key > stored > > on the most completely and utterly unreliable form of data storage still > > lamentably in use? Its not the 1970's anymore, get a real data storage > > medium! > > > > Get a usb flash drive, from there its a simple matter of changing the > geli > > script to mount a specific usb device before starting. Look in > > /etc/rc.d/geli and geli2. I'd put your mounting and checks between the > > kldstat and the "if [ -z" in the geli_start() sub. > > I have floppies from the 1980s that are still readable, but I have > never had a USB flash drive last more than six months when actually in > use. For important data, I trust a floppy far more than I trust a > flash drive. The big problem with floppies is they don't hold enough > data. For that matter, writeable CDs and DVDs have proven to be much > less reliable than floppies, too. > > - Bob > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org > " >