Re: IPMI console [Re: Chicken and egg, encrypted root FS on remote server]

2013-02-21 Thread Daniel O'Connor
On 21/02/2013, at 19:33, Steven Hartland kill...@multiplay.co.uk wrote: I had a quick look at the code and AFAIK it doesn't do anything (on 9.1 anyway). Actually at a guess I would say it's a hangover from sio(4) where 0x20 forced the device in question to be the console. According to

Re: IPMI console [Re: Chicken and egg, encrypted root FS on remote server]

2013-02-21 Thread Steven Hartland
- Original Message - From: Daniel O'Connor On 21/02/2013, at 9:06, Steven Hartland kill...@multiplay.co.uk wrote: If I change the console redirect to com1, my screen stays blank. Would you perhaps know how to use com1 for redirect and connect to it using ipmi-console (or ipmi-tool)?

Re: Chicken and egg, encrypted root FS on remote server

2013-02-20 Thread Paul Schenkeveld
On Wed, Feb 20, 2013 at 07:58:10AM +0100, Paul Schenkeveld wrote: Hi, I've been trying to find a solution for this chicken and egg problem, how to have an encrypted root filesystem on a remote server. Geli can ask for a root password at the console to unlock the root fs but that of course

Re: Chicken and egg, encrypted root FS on remote server

2013-02-20 Thread Wojciech Puchar
Geli can ask for a root password at the console to unlock the root fs but that of course won't work for a remote server. Ideally I'd like the server to start, do minimal network config, run a minimal ssh client (dropbear?) and wait for someone to log in, provide the passphrase to unlock the root

Re: Chicken and egg, encrypted root FS on remote server

2013-02-20 Thread Damien Fleuriot
On 20 Feb 2013, at 08:46, Paul Schenkeveld free...@psconsult.nl wrote: On Wed, Feb 20, 2013 at 02:42:57AM -0500, Jason Hellenthal wrote: Just a thought with no working example but… bootp / tftp - from a remote secured management frame to TX a key filesytem to unlock your rootfs. Could

Re: Chicken and egg, encrypted root FS on remote server

2013-02-20 Thread Paul Schenkeveld
On Wed, Feb 20, 2013 at 09:47:36AM +0100, Damien Fleuriot wrote: On 20 Feb 2013, at 08:46, Paul Schenkeveld free...@psconsult.nl wrote: On Wed, Feb 20, 2013 at 02:42:57AM -0500, Jason Hellenthal wrote: Just a thought with no working example but… bootp / tftp - from a remote secured

Re: Chicken and egg, encrypted root FS on remote server

2013-02-20 Thread Daniel O'Connor
On 20/02/2013, at 21:43, Paul Schenkeveld free...@psconsult.nl wrote: What about getting a remote console like HP's ILO or Dell's DRAC ? You get to login remotely, you can use some degree of access control... you can even remote boot. For new hardware I could indeed use this, the current

IPMI console [Re: Chicken and egg, encrypted root FS on remote server]

2013-02-20 Thread Paul Schenkeveld
Hi Daniel, On Wed, Feb 20, 2013 at 10:55:47PM +1030, Daniel O'Connor wrote: On 20/02/2013, at 21:43, Paul Schenkeveld free...@psconsult.nl wrote: What about getting a remote console like HP's ILO or Dell's DRAC ? You get to login remotely, you can use some degree of access control...

Re: IPMI console [Re: Chicken and egg, encrypted root FS on remote server]

2013-02-20 Thread Vincent Hoffman
On 20/02/2013 20:31, Paul Schenkeveld wrote: Hi Daniel, On Wed, Feb 20, 2013 at 10:55:47PM +1030, Daniel O'Connor wrote: On 20/02/2013, at 21:43, Paul Schenkeveld free...@psconsult.nl wrote: What about getting a remote console like HP's ILO or Dell's DRAC ? You get to login remotely, you

Re: IPMI console [Re: Chicken and egg, encrypted root FS on remote server]

2013-02-20 Thread Steven Hartland
- Original Message - From: Paul Schenkeveld free...@psconsult.nl To: Daniel O'Connor docon...@gsoft.com.au Cc: hack...@freebsd.org Sent: Wednesday, February 20, 2013 8:31 PM Subject: IPMI console [Re: Chicken and egg, encrypted root FS on remote server] Hi Daniel, On Wed, Feb 20

Re: IPMI console [Re: Chicken and egg, encrypted root FS on remote server]

2013-02-20 Thread Daniel O'Connor
On 21/02/2013, at 9:06, Steven Hartland kill...@multiplay.co.uk wrote: If I change the console redirect to com1, my screen stays blank. Would you perhaps know how to use com1 for redirect and connect to it using ipmi-console (or ipmi-tool)? We use the following on Supermicro servers works

Chicken and egg, encrypted root FS on remote server

2013-02-19 Thread Paul Schenkeveld
Hi, I've been trying to find a solution for this chicken and egg problem, how to have an encrypted root filesystem on a remote server. Geli can ask for a root password at the console to unlock the root fs but that of course won't work for a remote server. Ideally I'd like the server to start,

Re: Chicken and egg, encrypted root FS on remote server

2013-02-19 Thread Alexander Yerenkow
2013/2/20 Paul Schenkeveld free...@psconsult.nl Hi, I've been trying to find a solution for this chicken and egg problem, how to have an encrypted root filesystem on a remote server. Geli can ask for a root password at the console to unlock the root fs but that of course won't work for a

Re: Chicken and egg, encrypted root FS on remote server

2013-02-19 Thread Xin Li
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 2/19/13 10:58 PM, Paul Schenkeveld wrote: Ideally I'd like the server to start, do minimal network config, run a minimal ssh client (dropbear?) and wait for someone to log in, provide the passphrase to unlock the root filesystem and then

Re: Chicken and egg, encrypted root FS on remote server

2013-02-19 Thread Paul Schenkeveld
On Wed, Feb 20, 2013 at 09:14:22AM +0200, Alexander Yerenkow wrote: 2013/2/20 Paul Schenkeveld free...@psconsult.nl Hi, I've been trying to find a solution for this chicken and egg problem, how to have an encrypted root filesystem on a remote server. Geli can ask for a root password

Fwd: Chicken and egg, encrypted root FS on remote server

2013-02-19 Thread Jason Hellenthal
Meant to also reply all... Reply elsewhere... -- Jason Hellenthal JJH48-ARIN - (2^(N-1)) Begin forwarded message: From: Jason Hellenthal jhellent...@dataix.net Date: February 20, 2013 2:42:57 EST To: Paul Schenkeveld free...@psconsult.nl Subject: Re: Chicken and egg, encrypted root FS

Re: Chicken and egg, encrypted root FS on remote server

2013-02-19 Thread Paul Schenkeveld
On Wed, Feb 20, 2013 at 02:42:57AM -0500, Jason Hellenthal wrote: Just a thought with no working example but… bootp / tftp - from a remote secured management frame to TX a key filesytem to unlock your rootfs. Could be something as simple as a remote wireless adhoc server with a 64GB

Re: Chicken and egg, encrypted root FS on remote server

2013-02-19 Thread Alexander Yerenkow
As you may notice, I go way readonly freebsd, the upgrade is simply replace disk A with disk B, and all stays working. In my home setup there's no Vm, but SD card with base system, also in RO mode. This setup succesfully survived two upgrade-by-replace. And you always can keep old Os as backup.