remotely unlocking an encrypted hard disk
a day ago
- The author describes a problem: an encrypted boot partition on a remote desktop requires password entry at boot, preventing remote access after a power outage.
- The solution involves modifying the initramfs (initial RAM filesystem) to include networking, Tailscale, and SSH services.
- Constraints include key security, key expiration, and preventing unauthorized SSH access to the early boot environment.
- Mitigations include using Tailscale ACLs to restrict incoming connections, disabling key expiry, and limiting SSH commands to the unlock agent.
- The implementation requires installing dropbear SSH, sd-network, and tailscale hooks in Arch's mkinitcpio configuration.
- Steps include configuring network, SSH authorized keys, and rebuilding initramfs with mkinitcpio -P.
- The final result allows SSH into hostname-initrd to unlock the disk remotely.