I have some servers I'd like to keep on encrypted disks, but I don't want to have to manually type a passphrase at every boot. I also don't want to keep the key on the machine unencrypted. TPM would be a natural fit here, but what if someone steals the entire machine?
What if I set up a "cluster" of sorts, where each machine only stored the other machine's keys on something that was encrypted at rest? So now, only if all the machines in the cluster were offline at the same, a passphrase would be manually supplied, but only on one of the machines.
Each node would have an initramdisk with a dropbear instance and couple of scripts that would:
- Try detecting other nodes in the cluster.
- Send some request to the other node to turn around and log in via ssh, and supply the key for the local root filesystem.
- If no hosts are in the cluster, or no hosts have the appropriate ssh key, prompt for a passphrase.
This way, no keys are stored unencrypted anywhere, and I can reboot all my servers, so long as at least one stays up at a given time. If they're all down at once, I have to type a password.
Would this be an secure solution? If not, could the basic idea be modified to be made a secure solution?
(Also, is there an existing name for this type of setup?)