22 Jul 08:02
"Universal" keyscript for LVM encrypted systems with key on removable device
From: Swâmi Petaramesh <swami@...>
Subject: "Universal" keyscript for LVM encrypted systems with key on removable device
Newsgroups: gmane.linux.kernel.device-mapper.dm-crypt
Date: 2008-07-22 06:04:58 GMT
Subject: "Universal" keyscript for LVM encrypted systems with key on removable device
Newsgroups: gmane.linux.kernel.device-mapper.dm-crypt
Date: 2008-07-22 06:04:58 GMT
Hi folks, Debian and Ubuntu installers include a "standard" way of building a fully-encrypted machine on a LUKS-encrypted LVM. On top of this, I have written a more or less "universal" keyscript allowing the machine's LVM key to reside as a file on a removable device (i.e. USB key or SD-card) so this removable device will be the "key" for using the machine. That's quite convenient. The removable device partition on which the keyfile resides can be FAT, ext2/3, or itself a LUKS-encrypted partition in which case the bootkeyscript will prompt for its passphrase for unlocking it and getting the key to the machine's main encrypted LVM. This allows for "two form factor authentication". My script is rather automagic and doesn't need much more than being installed somewhere on the machine (typically /usr/local/sbin) and mentioned in /etc/crypttab before the initramfs is regenerated. It doesn't need no change to the standard Debian or Ubuntu encrypted LVM setup or initramfs (besides mentioning the needed kernel modules for accessing the removable device in /etc/initramfs-tools/modules and optionally adding 2 2-lines scripts in /etc/initramfs-tools/hooks for including a couple optional binaries in the initramfs.) The partition on which the keyfile resides can be mentioned in /etc/crypttab either by its device name (sdb1) or LABEL or fs UUID (for unencryted fs), or LUKS volume UUID (for encrypted fs), allowing it to work on machines on which the device ID where the key device is inserted may change from one boot to another.(Continue reading)
RSS Feed