Conversation

Notices

1. Embed this notice
   BjarniBjarniBjarni 🙊 🇮🇸 🍏 (herrabre@mastodon.xyz)'s status on Tuesday, 12-Nov-2024 19:15:41 JST BjarniBjarniBjarni 🙊 🇮🇸 🍏

   Proudly ashamed that I just kneecapped the full-disk #LUKS encryption on one of my personal #Linux servers.

   I decided that the device was in a secure-enough location, and being able to auto-start on boot (e.g. after a power outage) was more important than protecting the drive contents.

   This is the technique I used, which has the benefit that I can relatively easily reverse the change later on: https://web.archive.org/web/20140930221049/http://atterer.org/linux-remove-disable-luks-encryption-password-on-disk-partition-crypttab-initrd

   • Embed this notice
     Michał "rysiek" Woźniak · 🇺🇦 (rysiek@mstdn.social)'s status on Tuesday, 12-Nov-2024 19:15:39 JST Michał "rysiek" Woźniak · 🇺🇦

     in reply to

     @HerraBRE heh, I still prefer unlock-via-SSH, even though evil maid and all that.

   • Embed this notice
     Michał "rysiek" Woźniak · 🇺🇦 (rysiek@mstdn.social)'s status on Tuesday, 12-Nov-2024 19:30:56 JST Michał "rysiek" Woźniak · 🇺🇦

     in reply to

     @HerraBRE unlocking of LUKS root partition can be done directly in initramfs:
     https://neilzone.co.uk/2021/06/unlocking-a-luks-encrypted-partition-via-ssh-on-debian-10-and-debian-11/

     I use a version of this on a bunch of servers.

     But yeah, it needs network access, obviously.

     Anyway, whatever works. I am probably overdoing it with this. 😅

   • Embed this notice
     BjarniBjarniBjarni 🙊 🇮🇸 🍏 (herrabre@mastodon.xyz)'s status on Tuesday, 12-Nov-2024 19:30:58 JST BjarniBjarniBjarni 🙊 🇮🇸 🍏

     in reply to

     • Michał "rysiek" Woźniak · 🇺🇦

     @rysiek I still use that for some of the data (an external backup drive), but the machine needs to boot far enough to be on the network and accessible for that to work...

     This machine wasn't originally set up with this in mind, so it doesn't have separate root/home partitions.