search

agherzan / yubikey-full-disk-encryption

Use YubiKey to unlock a LUKS partition
Apache License 2.0
795 stars 50 forks source link

Idea: Unlock remote machine via SSH #57

Open Frederick888 opened 4 years ago

Frederick888 commented 4 years ago

This is a proof of concept which contains a lot of ugly hacks and it's not intended to be merged.

I would like to use yubikey-full-disk-encryption to unlock a headless machine without the hassle of unplugging/plugging YubiKey. So inspired by the encryptssh hook from mkinitcpio-utils I'm using currently, here's a prototype that utilises SSH port forwarding to achieve this job.

Server-Side Requirements
  1. nc from gnu-netcat
  2. ss from iproute2
  3. a patched mkinitcpio-dropbear (contains an upstream dss fix and a minor change to allow port forwarding)

dropbear (and netconf) needs to be pre-configured according to https://wiki.archlinux.org/index.php/Dm-crypt/Specialties#Remote_unlocking_(hooks:_netconf,_dropbear,_tinyssh,_ppp).

mkinitcpio hooks should look like:

HOOKS=(base udev autodetect keyboard keymap modconf block netconf dropbear ykfde filesystems fsck)
Client-Side Requirements
  1. ncat from nmap
  2. ykfde-ssh from this PR
Basically what it does is
  1. Server fires up network and dropbear
  2. Client uses ykfde-ssh Hostname and it: 1.1 starts ncat to listen on 127.0.0.1:9000 and wait for the challenge 1.2 forwards 127.0.0.1:9000 to Server
  3. Server uses ss to detect whether 127.0.0.1:9000 is open
  4. Server uses nc to send the challenge to 127.0.0.1:9000 and obtains the response

I've tested it in a virtual machine and it seems to work pretty smoothly. However the configuration does tend to be overly complex and I actually wonder whether there is a better way of doing this rather than using SSH port forwarding. But @agherzan if you feel comfortable about this idea I can then make some time to tidy it up and submit a proper PR.

agherzan commented 3 years ago

Shall we close this PR for now?

Frederick888 commented 3 years ago

Ah, sorry, got busy for a while then completely forgot about this. I still would like to finish this feature, but I can't give you a time frame right now. Is it ok? Or I'm also happy to submit another PR when I actually manage to wrap it up.

Vincent43 commented 3 years ago

Take your time, we can wait 😄

agherzan commented 3 years ago

That's absolutely alright. Just wanted to make sure it's still planned sometime in the future.

Piraty commented 3 years ago

https://github.com/dracut-crypt-ssh/dracut-crypt-ssh/ does that