| 1 |
> No comment on dracut as I have no experience with it. |
| 2 |
Okay, so I have to try it out myself. When I found something out, I expand the wiki with it. |
| 3 |
|
| 4 |
> |
| 5 |
> However, as I see it, you need no key file if you just use a pass |
| 6 |
> phrase. In my opinion, a key file is only necessary for two improvements: |
| 7 |
Entering just a pass phrase means that this pass phrase will be used to decrypt the device, if you decrypt a key before and then with that key decrypt all your volumes you have a much better security because that key will then be used as 'pass phrase' which is *way* much stronger (4096+ chars + ~10-20 chars you can remember). |
| 8 |
|
| 9 |
> |
| 10 |
> 1. Two-factor authentication (read: encrypted key file) |
| 11 |
> |
| 12 |
> 2. Avoiding re-typing the pass phrase for multiple dmcrypt partitions |
| 13 |
See above. :) |
| 14 |
|
| 15 |
> You can easily achieve the second point by putting an unencrypted key |
| 16 |
> file on the first partition which you encrypt with a pass phrase. You |
| 17 |
> don't even need dracut for this, /etc/conf.d/dmcrypt lets you configure |
| 18 |
> it easily (as long as it doesn't affect /usr). |
| 19 |
Okay, I look into this. |
| 20 |
|
| 21 |
> |
| 22 |
> However, I personally find it easier to put LVM on a single dmcrypt |
| 23 |
> volume and be done this. All you need for this to work are two lines in |
| 24 |
> /etc/rc.conf: |
| 25 |
> rc_dmcrypt_before="lvm" |
| 26 |
> rc_dmcrypt_after="udev" |
| 27 |
I'm new to LVM, does it setup key-based encryption (best is to put that key on an USB stick, so the attacker needs my stick). |
| 28 |
|
| 29 |
Regards, |
| 30 |
Roland |
Archives