From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.saout.de ([127.0.0.1]) by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m8V2Aa82Z_a7 for ; Fri, 8 Mar 2013 05:29:52 +0100 (CET) Received: from v4.tansi.org (ns.km33513-03.keymachine.de [87.118.94.3]) by mail.saout.de (Postfix) with ESMTP for ; Fri, 8 Mar 2013 05:29:52 +0100 (CET) Received: from gatewagner.dyndns.org (84-74-164-49.dclient.hispeed.ch [84.74.164.49]) by v4.tansi.org (Postfix) with ESMTPA id D6C021404001 for ; Fri, 8 Mar 2013 05:29:51 +0100 (CET) Date: Fri, 8 Mar 2013 05:29:51 +0100 From: Arno Wagner Message-ID: <20130308042951.GA13930@tansi.org> References: <5138F84C.30401@gmail.com> <20130307211746.GA6183@tansi.org> <51394CD4.4050605@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <51394CD4.4050605@gmail.com> Subject: Re: [dm-crypt] LUKS credential management at an enterprise level List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de On Thu, Mar 07, 2013 at 09:28:36PM -0500, Jeff Diehl wrote: > On 3/7/2013 4:17 PM, Arno Wagner wrote: > >In principle, any tool that can reasonably interface to > >a commandline interface can do this, see the FAQ and > >the man-page. > > > > Thanks. I did note that this was an option. It is also supported to do it that way, i.e. the commandline API stays stable if at all possible. There are extensive explanations in the man page on how to get things like passphrases in from outside, precisely if you want to use cryptsetup from a script. > >On the other hand, password rotation is a dead-end, and makes the > >problem worse, see e.g. > > > > http://www.schneier.com/blog/archives/2010/11/changing_passwo.html > > http://transvasive.com/index.php?option=com_content&id=46 > > > >The basic problem is that password rotation prevents the use > >of good, harder to remember passwords, while at the same > >time it does noting to increase security. Once somebody halfway > >competent has broken in, they will put in their own backdoor anyways. > >In the few instances I am subject to this stupid measure, I have taken > >to just attach the number of the month to the password. > > > > I probably should have made clear early on that the machines I am > interested in managing are not end-user machines. Ok, that is different. > They are a set of > "servers" in a data center. I am looking for "enterprise" features > that would allow me to manage LUKS credentials for a group of > machines (~50 boxen). These machines are not restarted with any > frequency and the LUKS credentials are only ever needed by an > authorized system administrator after a reboot. Ok. > For various > compliance reasons outside of my control, password rotation is > required. Well, yes. I know the problem. > In addition, I occasionally have a need to update/modify > LUKS passwords for this group of machines on-demand (e.g. exiting an > employee). Managing the machines individually is possible but > cumbersome and before creating a "home-grown" solution, I wanted to > see if there was something already available. I have done something a bit similar in the past for a cimputer cluster. The simplest thing was to have a machine that is allowed passwordless SSH-logins and then just run the scripts on that machine and execute them remotely via SSH, i.e. instead of having in you script "cryptsetup " on the machine itself use "ssh root@machine \"cryptsetup \"" You can even pipe things into stdin of the command that way: echo "blablubb" | ssh root@machine "| >The one enterprise feature that is important is a recovery > >password. For LUKS, this could be enforced either by policy, or > >by an adjusted set-up tool. For example, you could mandate that > >keyslot 8 always needs to contain a company recovery password > >or that a long, random password has to be put into keyslot 8 > >and then stored in a sealed envelope in a safe. > > > > Thanks. We use a process very similar to this for recovery. Ok, so you get it then. No need for me to comment any futher. Arno -- Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@wagner.name GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- One of the painful things about our time is that those who feel certainty are stupid, and those with any imagination and understanding are filled with doubt and indecision. -- Bertrand Russell