Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Recently, i installed FreeBSD for work and geli for encryption. (Full disk encyrption without boot partition.) When I finished getting it setup, I found that every time it boots, I need to enter the parse password to mount the root disk.

This is not for my needs. I just want my system to boot automatically, so i can ssh to it. But when others shutdown my machine, and try to use another freeBSD system to mount my disk, they can't. If they mount the partition with another FreeBSD system, they can only see /boot dir. All files are secure!

Is my concept possible? (To have an encrypted system boot automatically if mounted by another system?) And if so, how do I do it with freeBSD?

share|improve this question
1  
You want to boot automatically? No encryption. You want to encrypt it? No automatic boot. Those are your only options; pick your poison. –  HopelessN00b Jul 31 '12 at 14:43
add comment

2 Answers

up vote 1 down vote accepted

tl:dr: No

If you want the key to be used automatically on boot then the key must be accessible on boot. Which means on the unencrypted part of the disk.

If it is on the unencrypted part of the disk then other can take the disk out of your system, read the key and decrypt the rest of the disk.

There is no way to properly protect the disk and not to store the key.

share|improve this answer
    
He could, in principle, keep the key in some other place, like the nonvolatile memory that goes with the firmware. That would stop anyone being able to mount the disk on another machine, but would still allow walk-up access. It's still not a very good idea, though. –  Tom Anderson Aug 1 '12 at 12:18
1  
nonvolatile memory is a good idea. Personally I considered a pen drive in the USB plug, which is on many server style motherboards. But ultimately it comes down to two choices: 1) secure. 2) Fully bootable without entering a password. Where ever you store the pass phrase can be obscured, but it will never be completely safe. –  Hennes Aug 1 '12 at 13:09
add comment

No. If you wish to decrypt it automatically, you need to have your password stored on the disk in cleartext, or obscured in some (bad) way. Someone with enough willpower will be ably to get that password easily. If only "/boot" is unencrypted, the password has to be there, and the attacker just has to find it.

If you just don't wish to be physically present to unlock the server, it could be solved by having an unencrypted system installation, which would boot, start services like ssh which would enable you to unlock the data partition from a remote location.

share|improve this answer
    
...or get an IP KVM setup that would allow you to console in to enter the boot password remotely. –  HopelessN00b Jul 31 '12 at 14:42
    
This is most likely a workstation or laptop, not a server the way a professional sysadmin would think of a server. –  Michael Hampton Jul 31 '12 at 15:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.