Re: [gentoo-user] Initrd-script questions
On Tue, 18 Mar 2008 17:56:30 +0100, Florian Philipp wrote: > Third idea: Using a dedicated volume for storing the plaintext key. > Cumbersome, doesn't reduce the risk that srm isn't enough to protect the > key. You could use an encrypted volume to store the key. Your init script asks for the key for that volume, then all other volumes use key(s) stored on that volume. I do this, but have no idea how it will work with suspend. -- Neil Bothwick Light travels faster than sound. This is why some people appear bright until you hear them speak. signature.asc Description: PGP signature
[gentoo-user] Initrd-script questions
Hi list! I'd like to have some advice on my situation: I have a custom init-script (derived from genkernel). What it already does is to let gpg ask for a passphrase to decrypt a file on /boot and then to use to content of that file as the key to a LUKS-formatted swap (logical volume) which is then used to resume from disk. What I would also like to do is to use the very same key for other lvm-volumes like /var and /var/tmp but that doesn't seem that easy. First idea: Just do the same as with the swap-volume. However, all other mappings are gone after resuming/booting. Second idea: Write the plaintext-keyfile to /boot and then use it via /etc/conf.d/cryptfs before removing it in a secure manner (srm, provided by app-misc/secure-delete). Problem: When resuming, /boot is already mounted. Writing to it and then resuming leads to filesystem corruption. Third idea: Using a dedicated volume for storing the plaintext key. Cumbersome, doesn't reduce the risk that srm isn't enough to protect the key. So ... what I'd need is a way to transfer data between an initial ramdisk and the real init. Ideally in form of tmpfs-mountpoint. I don't think my odds are very high but I just wanted to ask... Thanks in advance! Florian Philipp signature.asc Description: This is a digitally signed message part
