On Mon, Feb 17, 2020 at 11:56:24AM +0100, Paul de Weerd wrote:
But you can already do this. If your machine supports booting from
USB, you can do a minimal install to a USB stick (using FDE, if you
want). Now you have a portable OpenBSD environment you can boot on
any system capable of booting from USB (and supporting the same kernel
architecture).
What you can also do with this USB stick is use its bootloader to boot
the OS stored on the disk inside your machine (FDE encrypted or not).
I've used this to fix up installs gone sour on my machines in the
past. Works a treat. I don't use it to prevent the evil maid case
you describe though, but I think it would work just fine.
| This way the evil maid would have nothing to tamper with.
Note that with this approach, a default OpenBSD install to your
machine will still install a bootloader on the physical disk inside
your machine. It's then on you to NOT use that.
That's a heck of a hack!
