Hello, On Sat, Sep 15, 2018 at 11:52:01PM +0200, deloptes wrote: > I also wish I knew how to get ssh into initrd and the whole networking, so > that I could do it remotely when needed.
I've never done it myself, as I have IPMI access to anything I care about, but it appears to be as simple as installing and configuring the dropbear-initramfs package. This guide is for Ubuntu but looks like it would translate to Debian well: https://hamy.io/post/0009/how-to-install-luks-encrypted-ubuntu-18.04.x-server-and-enable-remote-unlocking/ Also: https://wiki.debian.org/RescueInitramfs I've also heard of people who use key/value stores or software password safes or whatever to request the passphrase at boot time in order to do completely automated boots. The obvious problem there is an attacker who gets hold of the initramfs in order to be able to use the credentials to request the passphrase themselves. For those who wanted to get more elaborate (and more likely to mess up and leave their server a useless encrypted brick), there are things like Mandos: https://wiki.recompile.se/wiki/Mandos https://www.recompile.se/mandos/man/intro.8mandos "This is the the Mandos system, which allows computers to have encrypted root file systems and at the same time be capable of remote and/or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key; each client has one unique to it. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system, whereupon the computers can continue booting normally." Cheers, Andy -- https://bitfolk.com/ -- No-nonsense VPS hosting Please consider the environment before reading this e-mail. — John Levine