On Tuesday, December 3, 2019 12:35:01 PM MST Przemek Klosowski via devel wrote: > I think Chris is referring to the fact that you have to be there when > the encrypted system is restarted, to type the decryption key/password. > The dilemma is this: if the decryption is automatic, it doesn't really > protect the data at rest, because the boot process is not secured like > it is on Android or IOS, and therefore the intruders could get in and > access the now-unencrypted disk. > > It is conceivable to set up some sort of location-based decryption, > where you would not have to give the password if the system is on a > known network, authenticating through a trusted interface to a known > host, but it's not a solved problem. There are solutions for this, in the form of dracut modules that spawn an SSH server, and wait for you to connect and unlock the system, if you are not available to unlock it physically. Network based decryption keys are possible, but I don't recommend it, because there's no way to determine that the user booting up the system is actually meant to have access to the data that's on it. However, if you're interested in network based keys for that purpose, that'd be a surprisingly simple project. I believe there was a blog post from a Red Hat engineer a few years ago about network based luks volume decryption. -- John M. Harris, Jr. Splentity _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
