I've several machines at home: A small nas, my notebook, a litte webserver etc.

Some of these machines store my entire digital life - so I encrypted nearly every partition. To boot up the devices, I have to type in about 5 passphrases to different machines.

I'm searching for a small key distribution server: A RPI (or something else) based system which I can boot and unlock first and where the other machine can get their keyfiles from.

The authentication could be done by SSH key auth or x509-auth over HTTPs. As a bonus the machines may automatically lock the partitions if the keyserver is unreachable for a specific amount of time or sends some kind of an emergency signal.

I can't believe that noone developed such a tool...

  • close vote retracted and custom message removed. @Zanna – Fabby Mar 3 '17 at 13:06

I've put together a fairly simple keyscript for retrieving keys over HTTPS. I was trying to solve the same problem I believe you are - securing a machine against untargeted theft while still allowing reboots without having to unlock manually every time.

The key is stored encrypted on the other server, and you can configure basic authentication fairly easily - none of this particularly helps of course once someone's stolen the relevant machine! You'll still have to manually respond to the theft quickly by making the keys unavailable.

I suppose in your scenario, the expectation would be that someone was shutting all your machines down at (roughly) the same time, and that in any case the 'keyserver' was only available on the local network.

(My HTTP server is on the public internet, but I've limited access using GeoIP and my ISPs IP ranges, which might provide some protection if I'm lucky.)

Encrypting the key in my arrangement probably doesn't provide much benefit, I have to admit. (But it doesn't make things much more complicated.)

mandos is an attempt to solve a similar problem but tries to ensure that keys will be made unavailable quickly and automatically if a machine appears to have been stolen. This means it requires assumptions about downtime and a slightly more convoluted infrastructure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.