Em 05-03-2014 18:22, Ted Unangst escreveu: > On Wed, Mar 05, 2014 at 17:48, Giancarlo Razzolini wrote: >> Thank you for your reply. I am tending for the generic solution for >> unlocking it via network. Not using console nor any hardware assist. On >> linux, using initramfs + busybox + dropbear + some other hacks, it works >> quite well and secure, since you unlock it through ssh. > That sounds like something less than full disk encryption. Yes, the boot section must be unencrypted unless you use an external device (ie. pendrive, usb disk) to boot it. But this is not generic and not very useful. > I'd just do what you had to do before boot supported encryption. Put > /home or wherever your data is in softraid, mark it 0 0 in fstab, and > then after you boot, login and bioctl/mount it manually. > > I think FDE is useful on a notebook/desktop where you may reboot > somewhat frequently, but always have console access. It's easier and > it spares me from typing my password half way through the boot sequence. > > On a server, this is only making things harder for no additional > security. You don't know when initramfs sshd actually starts, so you're > going to what, ping it until you get an answer? Protect the things that > are important, leave the rest alone. I put a lot of intelligence on the configuration of the services that the machine run, and I prefer to have /etc and everything else encrypted. If not, I would have to move lots of configuration files to the encrypted partition, not to mention that it would very error prone. Servers generally have more sensitive data, so full disk encryption make perfectly sense. I don't want one of my servers to be physically stolen and to worry if I didn't leaved anything behind laying in the unencrypted root partition. > > The only advice would be to start fewer daemons in rc. Just start > sshd. Then start mail or web server or whatever later, assuming you > want their data encrypted. This is a five line shell script that > means you're still running OpenBSD, not bizarro almost but not really > OpenBSD. > > I want logs encrypted. They contain lots of information that could be used on an attack. Just to mention user names, if I leave sshd unencrypted.
One byproduct of such design would be the possibility of redirecting the console to the ssh connection. I know this is deranging from the initial idea, but make perfect sense. Anyway, I noted your concerns on this. Now, anyone have any design idea for implementing this? Cheers, -- Giancarlo Razzolini GPG: 4096R/77B981BC
