Bug 459814
| Summary: | Feature request: add ssh (dropbear?) to initrd to enable remote unlocking and boot of encrypted systems | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Kevin R. Page <redhat-bugzilla> |
| Component: | mkinitrd | Assignee: | Peter Jones <pjones> |
| Status: | CLOSED WONTFIX | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 9 | CC: | dcantrell, fedora, jonas, myroslav, ralph, schefister, ultimatetux, wtogami |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-05-06 15:33:45 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Attachments: | |||
|
Description
Kevin R. Page
2008-08-22 16:05:22 UTC
Well, I've managed to back-port what this scripts do, so far I can get a dropbear in my initrd up and running, things could've been much more messy however I chose to increase the initrd size by 2mb using busybox over copying every binary I need inside the initrd, it was easy as long as you know your network device modules and their dependencies, also I think things that should be put in mind is that when implementing such capability in fedora is.. 1. the case of a kernel update 2. the case of a hardware change (mostly the network card) other problems may apply but those are the ones in my mind now. May be if you want I could write you a how to or cook some script to do the job of hacking the initrd, and may be someone do a yum-crypsetup plug-in. /* || Thanks, Ahmed Medhat || ultimatetux [at] gmail [dot] com || In a world without walls and fences, who needs Windows and Gates? */ I tried to create my own initrd environment for unlocking encrypted disk (from default initrd img created by FC10). I added some binaries busybox, dropbear, and my network modules (currently testing in vmware so added e1000). I could get eth0 up, dropbear listen and connect. Almost fine but dropbear gives an "access denied" to the client and complains about a nonexistent user on server. I have passwd and shadow in initrd /etc folder. Any help on how you managed to create the script would be much appreciated. Thank you. This isn't something we're going to add to current mkinitrd as its pretty complex to do securely. In the comments at this page http://www.howtoforge.com/unlock-a-luks-encrypted-root-partition-via-ssh-on-ubuntu is patch for CentOS which will do exactly what is asked for here. Also see this http://www.phys.uconn.edu/Members/rozman/unlocking-luks-encrypted-partition-via-ssh-on-fedora In my opinion the explanation from Jeremy why this request was closed is not entirely fair, just because something is difficult to do but it is very useful and doable. In relation to this request I also suggest looking at request https://bugzilla.redhat.com/show_bug.cgi?id=580807 which requests ability to unlock LUKS root volume using USB key. The patch for mkinitrd to accomplish this again in CentOS is available here http://www.gno.org/~gdr/sysadmin/centos/5.4/usb-crypto-key.html These two requests combined would provide very useful way of protecting ones system. Created attachment 474522 [details] Patch to enable dropbear in mkinitrd to allow unlocking LUKS encrypted root partition over SSH Copied from http://www.howtoforge.com/unlock-a-luks-encrypted-root-partition-via-ssh-on-ubuntu#comment-23372 Created attachment 474523 [details] Improvement to the previously submitted patch to enable dropbear in mkinitrd to allow unlocking LUKS encrypted root partition over SSH Copied from http://www.howtoforge.com/unlock-a-luks-encrypted-root-partition-via-ssh-on-ubuntu#comment-24307 |