Score:0

LUKS decrypt on boot with web based key?

cn flag

Is it possible to configure LUKS to grab a key file from a web server and use it to decrypt and mount the drive on boot?

The idea being that this allows the device to boot, decrypt, and start running without any intervention, but should the device be stolen I can simply nuke the key from the web server and the drive is no longer decrypted automatically.

I didn't see anything in /lib/cryptsetup/scripts so I'm wondering if there's another option available to do this?

Yes, I realize this hinges on the premise that the thief doesn't boot the system up, check the config and download a copy of the key before I can delete it from the web server, but that's an acceptable risk in this case.

Score:0
fr flag

You should have a look at clevis and tang.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.