On 7/7/19 10:29 AM, Arnt Karlsen wrote:
..5.3.8. Calamares installer leaves disk encryption keys readable:
https://www.debian.org/releases/buster/amd64/release-notes/ch-information.en.html#calamares-creates-readable-key
Is this referring to the use of a keyfile in the initrd? Or is this the
case in all encrypted debian-based systems, whether /boot is part of the
encrypted volume or not?
Bug report says:
"It installs an encryption key in the initramfs, the problem is
that in Debian, the initramfs is world readable by default, which
means that a user on an unlocked system could retrieve the unlock
key."
/etc/cryptsetup-initramfs/conf-hook says:
# KEYFILE_PATTERN: ...
#
# The value of this variable is interpreted as a shell pattern.
# Matching key files from the crypttab(5) are included in the initramfs
# image. The associated devices can then be unlocked without manual
# intervention. (For instance if /etc/crypttab lists two key files
# /etc/keys/{root,swap}.key, you can set KEYFILE_PATTERN="/etc/keys/*.key"
# to add them to the initrd.)
Thanks to anyone who can shed some light on this.
fsmithred
_______________________________________________
Dng mailing list
Dng@lists.dyne.org
https://mailinglists.dyne.org/cgi-bin/mailman/listinfo/dng
