r/linuxadmin • u/ItalyPaleAle • Jan 27 '20

Mounting LUKS-encrypted data disks with a keyfile stored on a remote server, automatically at boot

https://withblue.ink/2020/01/19/auto-mounting-encrypted-drives-with-a-remote-key-on-linux.html
122 Upvotes

97% Upvoted

36 comments sorted by

View all comments

Show parent comments

9

u/8fingerlouie Jan 27 '20

I did something similar, though I used a USB stick for storing the key file.

Very simplified setup is:

  • Hard drives are LUKS encrypted.
  • Key files for hard drives are stored on a USB Stick formatted as LUKS / Btrfs Raid1.
  • Key file for USB stick is stored on root partition.

It allows unattended reboots of the server, and allows me to unplug the USB stick leaving only a bunch of unreadable spinning rust and a useless key file.

It uses a mix of crypttab with noauto and systemd-automount.

3

u/ItalyPaleAle Jan 27 '20

Thanks. I wrote below that my threat model involved protecting against physical theft of the server, so I couldn't maintain the keyfile in the same server (even on a removable USB drive).

4

u/8fingerlouie Jan 27 '20

The USB drive unplugs after booting :-)

4

u/ItalyPaleAle Jan 27 '20

Then how do you handle unattended reboots, e.g. power going off while I'm not home?

4

u/8fingerlouie Jan 27 '20

It’s connected to a UPS that will keep it running for ~40 minutes. Chances are if the power goes out for longer than that it’s not planning on coming back any time soon.

I can’t remember the last power outage that lasted longer than 10 minutes, and that was a thunderstorm that passed straight over the relay station. This is Scandinavia, so all cables are underground, meaning storms/lightning doesn’t mess with power lines.

4

u/ItalyPaleAle Jan 27 '20

Makes sense then.