From owner-freebsd-hackers@FreeBSD.ORG  Wed Feb 20 08:19:37 2013
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by hub.freebsd.org (Postfix) with ESMTP id D7BCFFCA;
 Wed, 20 Feb 2013 08:19:37 +0000 (UTC)
 (envelope-from freebsd@psconsult.nl)
Received: from mx1.psconsult.nl (unknown [IPv6:2001:7b8:30f:e0::5059:ee8a])
 by mx1.freebsd.org (Postfix) with ESMTP id 5EE8EA64;
 Wed, 20 Feb 2013 08:19:36 +0000 (UTC)
Received: from mx1.psconsult.nl (mx1.hvnu.psconsult.nl [46.44.189.154])
 by mx1.psconsult.nl (8.14.5/8.14.4) with ESMTP id r1K8JUGn094304
 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
 Wed, 20 Feb 2013 09:19:35 +0100 (CET)
 (envelope-from freebsd@psconsult.nl)
Received: (from paul@localhost)
 by mx1.psconsult.nl (8.14.5/8.14.4/Submit) id r1K8JUOk094303;
 Wed, 20 Feb 2013 09:19:30 +0100 (CET)
 (envelope-from freebsd@psconsult.nl)
X-Authentication-Warning: mx1.psconsult.nl: paul set sender to
 freebsd@psconsult.nl using -f
Date: Wed, 20 Feb 2013 09:19:30 +0100
From: Paul Schenkeveld <freebsd@psconsult.nl>
To: freebsd-hackers@freebsd.org, hackers@freebsd.org
Subject: Re: Chicken and egg, encrypted root FS on remote server
Message-ID: <20130220081930.GB59952@psconsult.nl>
References: <20130220065810.GA25027@psconsult.nl>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20130220065810.GA25027@psconsult.nl>
User-Agent: Mutt/1.5.21 (2010-09-15)
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
 <freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-hackers>, 
 <mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
 <mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 20 Feb 2013 08:19:37 -0000

On Wed, Feb 20, 2013 at 07:58:10AM +0100, Paul Schenkeveld wrote:
> Hi,
> 
> I've been trying to find a solution for this chicken and egg problem,
> how to have an encrypted root filesystem on a remote server.
> 
> Geli can ask for a root password at the console to unlock the root fs
> but that of course won't work for a remote server.
> 
> Ideally I'd like the server to start, do minimal network config, run
> a minimal ssh client (dropbear?) and wait for someone to log in,
> provide the passphrase to unlock the root filesystem and then mount
> the root filesystem and do a normal startup.
> 
> I read about a pivotroot call in other OS-es, that would allow for a
> very small unencrypted root filesystem to be mounted temporarily until
> the passphrase has been entered and then swap that for a real, encrypted
> root filesystem.  But AFAIK we don't have pivotroot.
> 
> The problem could also be solved if the real root fs could be union
> mounted over the small unencrypted one but unionfs won't mount over /.

Why is it that I cannot union mount anything over /, is there a
technical reason for that or is it because of security concerns?