Just did a quick test. Seems feasible to use clevis w/ tpm2 to securely
bind credentials to a machine. The idea is:
- in case of new install there are no machine-specific files
- secrets gets generated as usual
- once the machine is up & running, use ssh to run a script to
encrypt the
Tks for the answer. Sorry for seeing it late but it went in the spam
folder :(
I didn't know clevis/tang, but it's really interesting (maybe a bit
overkill in my scenario).
Diego
Il 15/12/2022 18:53, Robert Markula ha scritto:
Am 15.12.22 um 18:15 schrieb Toomas Tamm via linux-fai:
This
Il 15/12/2022 18:15, Toomas Tamm via linux-fai ha scritto:
Some things that I can imagine that could mitigate such risks would be:
- Inputting some secret on the physical machine during install (from the keyboard, USB
stick, etc). This would defeat the idea of "fully automatic" install.
Am 15.12.22 um 18:15 schrieb Toomas Tamm via linux-fai:
This message was wrapped to be DMARC compliant. The actual message
text is therefore in an attachment.
Hi Toom,
unforunately I can't quote you directly, but regarding a rogue attacker
mimicking the MAC of an install client: You have to
his
would not prevent successful attacks, but possible breaches could be patched
up, eg keys replaced afterwards.
BR,
Toomas
-Original Message-
From: linux-fai On Behalf Of Diego Zuccato
Sent: kolmapäev, 14. detsember 2022 07:40
To: linux-fai@uni-koeln.de
Subject: Re: Secure deploy of
Am 13.12.22 um 14:47 schrieb Diego Zuccato:
Hello all.
What's the recommended way to deploy (or re-deploy) security-sensitive
objects (just to say one: private ssh key to avoid client warnings
when redeploying a server)?
You could use RedHat's Latchset framework [1] with Clevis (on the
Tks.
Too bad I fear it's not applicable to my scenario.
First because the network is public. Second because ssh is just one of
the secrets I have to distribute (others are usually SaltStack key and
Gluster certificate).
I'm thinking that probably this is one of the few cases where a TPM is
Hey,
On Tue, 2022-12-13 at 14:47 +0100, Diego Zuccato wrote:
> What's the recommended way to deploy (or re-deploy) security-
> sensitive
> objects (just to say one: private ssh key to avoid client warnings
> when
> redeploying a server)?
For things like ssh host keys I have a command that we
Hi all,
What's the recommended way to deploy (or re-deploy) security-sensitive
objects (just to say one: private ssh key to avoid client warnings
when redeploying a server)?
One solution that comes to my mind is to generate a local GPG key and
then authorize it for using a pass store
Hello,
I would be very interested if you find any solutions. By design, the FAI config
space has to be somewhere where it is accessible without access control
(anonymous NFS or whatever), and everything within it obviously has to be
readable.
I guess you will need to find other solutions. As
Hello all.
What's the recommended way to deploy (or re-deploy) security-sensitive
objects (just to say one: private ssh key to avoid client warnings when
redeploying a server)?
TIA
--
Diego Zuccato
DIFA - Dip. di Fisica e Astronomia
Servizi Informatici
Alma Mater Studiorum - Università di
11 matches
Mail list logo
