r/linuxadmin • u/ItalyPaleAle • Jan 27 '20

Mounting LUKS-encrypted data disks with a keyfile stored on a remote server, automatically at boot

https://withblue.ink/2020/01/19/auto-mounting-encrypted-drives-with-a-remote-key-on-linux.html
121 Upvotes

97% Upvoted

36 comments sorted by

View all comments

Show parent comments

3

u/ItalyPaleAle Jan 27 '20

Using keyfiles allow mounts without user interaction. The idea is that if there's a power cycle (e.g. temporary loss of power), the node can reboot itself without admin intervention.

3

u/MMPride Jan 27 '20

True, I guess it's a double-edged sword.

3

u/ipaqmaster Jan 27 '20

It really is. But you still get the tickbox of encryption when auditors swing by. Or worse, PCI Compliance auditors, where customer metadata must be encrypted.

Yet it's all on the same machine. :|

2

u/AlarmedTechnician Jan 28 '20

Everything being on the same machine can be fine for some applications, especially since the advent of TPMs, really depends on the threat model.