Date: Mon, 25 Nov 2019 09:15:12 -0600 From: Karl Denninger <karl@denninger.net> To: freebsd-questions@freebsd.org Subject: Re: Geli password over network strategies Message-ID: <070fde61-d128-bae6-b381-75c9a204980b@denninger.net> In-Reply-To: <9dd8e65a-afdd-514f-0dc0-6bb60b9faaab@florencepaul.com> References: <4ac6ee31-ab05-97f6-da4b-c2d798651fdf@florencepaul.com> <9dd8e65a-afdd-514f-0dc0-6bb60b9faaab@florencepaul.com>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --] On 11/25/2019 08:45, Paul Florence via freebsd-questions wrote: > Hello everyone, > > I am currently running a home-made server with 12.0-RELEASE-p10 using > full disk geli encryption. When I boot the server, I first have to > type a password to decrypt the whole system. > > However, my ISP is having some power issues and in the last few weeks > I had to go there quite a few times to type a passphrase. > > I would like now to be able to enter my passphrase over the network. > > Would the following boot process be possible ? > > 1. First boot from an unencrypted kernel from a USB stick. > > 2. Then start an SSH server. > > 3. Input my passphrase over an ssh terminal. > > 4. Use the provided passphrase as the geli secret to boot the OS from > the disk > > If no, has anyone had to deal with this kind of problem ? If so, what > kind of strategy did you decide to use ? > Yep. My infrastructure is UPS backed but UPS batteries run out and then things shut down. When power comes back, well, I'd like to be able to enter that password with REASONABLE security. Here's my strategy for dealing with it. Front-end the server with something that is a dedicated firewall and WILL reboot on power fail and come back to multi-user, normal mode (I use a pcEngines box that boots off SD and runs with root mounted read-only; there is thus essentially zero risk of said box not coming all the way back up unattended.) It runs StrongSwan. Now from "wherever" I can either ssh or VPN into that after a power failure. The main box is, at this point, sitting at a console prompt asking for a GELI password as the loader requires it to unlock the root ZFS pool. I now have choices; I could have the big box set up to go to a serial console and have the serial port plugged in but instead my usual choice is to instead use the existing "big box's" IPKVM feature which I can access via two means -- either over the VPN (since my laptop now appears to be on the local LAN which has the IPKVM port on it) or I can sign into the gateway and use "ssh" to set up a temporary tunnel to the https: port on the IPKVM interface thereby allowing me to directly do a "https://gateway-ip-address:whateverport" and sign into the IPKVM that way, then use its functionality to get direct console access. Either way the session is encrypted so the password cannot be picked off. -- Karl Denninger karl@denninger.net <mailto:karl@denninger.net> /The Market Ticker/ /[S/MIME encrypted email preferred]/ [-- Attachment #2 --] 0 *H 010 `He 0 *H 00 H^Ōc!5 H0 *H 01 0 UUS10U Florida10U Niceville10U Cuda Systems LLC10U Cuda Systems CA1!0 U Cuda Systems LLC 2017 CA0 170817164217Z 270815164217Z0{1 0 UUS10U Florida10U Cuda Systems LLC10U Cuda Systems CA1%0#U Cuda Systems LLC 2017 Int CA0"0 *H 0 h-5B>[;olӴ0~͎O9}9Ye*$ g !ukvʶLzN`jL>MD'7U 45CB+kY`bd~b*c3Ny-78ju]9H euέsӬDؽmgwER?&UURj'}9nWD i`XcbGz \gG=u%\Oi13ߝ4 K44pYQr]Ie/r0+eEޝݖ0C15Mݚ@JSZ(zȏ NTa(25DD5.l<g[[Z arQQ%Buȴ~~`IohRbʳڟu2MS8EdFUClCMaѳ !}ș+2k/bųE,n当ꖛ\(8 WV8 d]b yXw ܊:I39 00 U ]^§Q\ӎ0U #0T039N0b01 0 UUS10U Florida10U Niceville10U Cuda Systems LLC10U Cuda Systems CA1!0 U Cuda Systems LLC 2017 CA @Ui0U 0 0U 0 *H :P U!>vJ n io -#ן]Wyu jǑR̀Q nƇ!G ѦF g\ yLx gw=OPycehf[ }ܷ['4ڝ\[p 6\o.B&JF" ZC{;*o*mcCcLY߾` t*S!(` ]DHP5A~/NPp6=mhk밣'doA$86hm5ӚS@ j ެEgl )0JG`%k35PaC?σ ׳HEt}!P㏏%*BxbQwaKG$6 h¦Mve; [o-Iی& I,Tc ߎ#t wPA@l0P+KXBպT zGv;NcI3&J ĬUPNa?/%W6G۟N000 k#Xd\ =0 *H 0{1 0 UUS10U Florida10U Cuda Systems LLC10U Cuda Systems CA1%0#U Cuda Systems LLC 2017 Int CA0 170817212120Z 220816212120Z0W1 0 UUS10U Florida10U Cuda Systems LLC10U karl@denninger.net0"0 *H 0 T[I-ΆϏ dn;Å@שy.us~_ZG%<MYd\gvfnsa1'6Egyjs"C [{~ _K Pn+<*pv#Q+H/7[-vqDV^U>f%GX)H.|l`M(Cr >е͇6#odc"YljҦln8@5SA0&ۖ"OGj?UDWZ5 dDB 7k-)9Izs-JAv J 6L$Ն1SmY.Lqw*SH;EF'DĦH]MOgQQ|Mٙג2Z9y@ y]}6ٽeY9Y2xˆ$T=e CǺǵbn֛{j |@LLt1[Dk5:$= ` M 00<+00.0,+0 http://ocsp.cudasystems.net:88880 U 0 0 `HB0U 0 U %0++03 `HB &$OpenSSL Generated Client Certificate0 U %՞V =;bzQ0U #0]^§Q\ӎϡ01 0 UUS10U Florida10U Niceville10U Cuda Systems LLC10U Cuda Systems CA1!0 U Cuda Systems LLC 2017 CA H^Ōc!5 H0 U 0karl@denninger.net0 *H ۠A0-j%--$% g2#ޡ1^>{K+uGE v1ş7Af&b&O; .;A5* U)ND2bF|\= ]<sˋL!wrw٧> YMÄ3\mWR hSv!_zvl? 3_ xU%\^#O*Gk̍YI_&Fꊛ@&1n } ͬ:{hTP3B.;bU8:Z=^Gw8 !k-@xE@i,+'Iᐚ:f hztX7/(hY` O.1}a`%RW^akǂpCAufgDix UTЩ/7}%=jnVZvcF<M= 2^GKH5魉 _O4ެByʈySkw=5@h.0z> W1000{1 0 UUS10U Florida10U Cuda Systems LLC10U Cuda Systems CA1%0#U Cuda Systems LLC 2017 Int CA k#Xd\ =0 `He E0 *H 1 *H 0 *H 1 191125151512Z0O *H 1B@ ?._@5m w.G bQJ).GP T 3 CX1e0l *H 1_0]0 `He*0 `He0 *H 0*H 0 *H @0+0 *H (0 +7100{1 0 UUS10U Florida10U Cuda Systems LLC10U Cuda Systems CA1%0#U Cuda Systems LLC 2017 Int CA k#Xd\ =0 *H 10{1 0 UUS10U Florida10U Cuda Systems LLC10U Cuda Systems CA1%0#U Cuda Systems LLC 2017 Int CA k#Xd\ =0 *H b~m.G!X Uꄆ )/E^nv %pz U溝 HFuF#s(LAj<R7LkUTu[Ǝp? wLA}0 0?;3`x[x)xPzKf`)HܣB@<bZf~[&(6#@s< uj+-%q)H@<oQ/Jb J\*UR`ȋ#*X.s8!F,x?Ck`^72C(L괈%su>mK tfVj6}0t.\N=6LVN(.'vb1/MGDŦc89d< ħ+1<tKh'߮E %J0% 4"EN;[>Ԣ7Ms._ .~W0|AІ±help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?070fde61-d128-bae6-b381-75c9a204980b>