Re: [dm-crypt] Remote unlock security

[epvdm@limpoc.com]

On Tue, Dec 21, 2010 at 06:27:41AM +0100, Arno Wagner wrote:
> 
> Hi David,
> On Mon, Dec 20, 2010 at 08:05:25PM +0100, David Jacquet wrote:
> > Hi,
> > 
> > I am trying to configure my server to be able to be unlocked via ssh and
> > dropbear. From the README.gz
> > I understand that I can issue the command:
> > 
> > ssh -o "UserKnownHostsFile=~/.ssh/known_hosts.initramfs" \
> > -i "~/id_rsa.initramfs" root@initramfshost.example.com \
> > "echo -ne \"secret\" >/lib/cryptsetup/passfifo"
> > 
> > What exactly will happen with the "secret" string? Will it be written to an
> > unprotected part of a hard drive. 
> 
> I do not understand what "passfifo" is suppoded to do, you 
> should probably do something like this instead:
> 
> ssh "cat <file-with-secret> | cryptsetyp --key-file - <other options>"
> 
> > If so
> > it may be retrieved by a careful investigation of that drive. From my non
> > expert and humble opinion, a key (as
> > the "secret") should only be stored on RAM (and erased even from the RAM as
> > soon as possible).
> 
> Indeed. However "as soon as possible" is on device removal from
> LUKS/dm-crypt control.
>  
> > Even if only stored in the RAM, I guess that the "secret" string will be
> > stored in the .bash_history file on the
> > computer from which the ssh-command was issued. 
> 
> Therefore never show it to bash.
> 
> > I guess it is more
> > recommended to log into the remote
> > computer and then issue ( cat > /lib/cryptsetup/passfifo --> "secret" -->
> > CTRL+D, will that work?)
> 
> Still don't get what "passfifo" is for. Is this some contruction
> like this?
> 
>   mkfifo passfifo
>   cryptsetup --key-file passfifo
> 
> Arno


apparently in some linux distributions the initrd cryptdisk setup reads the
password from a fifo. 

regardless when setting up something like this, it's important to realize that
if you care about the actual security of the data and your passphrase, this is
not a safe arrangement unless you can independently confirm that the machine
you're trying to unlock hasn't been tampered with. For instance, an attacker
could modify the (unencrypted) initramfs to save whatever passphrase you type
remotely. 

Of course if you just use encrypted disks for convenience, e.g., so you don't
have to worry about scrubbing them before discarding old equipment, it doesn't
matter. 

eric