<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Hi Victor,<br>
</p>
<p>I totally agree with your comment, our second step is to
protect/hide/whatever the key store.</p>
<p>Regards<br>
</p>
<div class="moz-cite-prefix">On 25/08/16 18:28, Victor Palau wrote:<br>
</div>
<blockquote
cite="mid:CAAN86V7AgFz+Cho-qUQHBkKCsxkhozGaGvhvgq60S1Sx=N6mZQ@mail.gmail.com"
type="cite">
<div dir="ltr">Hi Xavier,
<div class="gmail_extra"><br>
<div class="gmail_quote">On Thu, Aug 25, 2016 at 5:10 PM,
Xavier Pegenaute M2M <span dir="ltr"><<a
moz-do-not-send="true"
href="mailto:xavier.pegenaute@nexiona.com"
target="_blank">xavier.pegenaute@nexiona.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">Hi
Tyler, All,<br>
<br>
my use case is something like this:<br>
<br>
we develop some software that can be installed in some
hardware provided by the client. One of our clients
requires a snappy distribution. To protect our data we
need to encrypt all FSs in the snappy. Even if at the
moment we have some weak points such as the place were we
store the keys. It is not expected to have a human around
every time the snappy boots but time to time it may be
possible.<br>
Our goal is to protect the content in case some one takes
the hardware and mount the partitions as an external
drive.<br>
</blockquote>
<div>But surely if someone takes the hardware, they just
need to boot it and it will decrypt itself. So unless you
are storing the decryption key outside the device I am not
sure how this will provide you additional security. no? </div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex"> <br>
To do so I want to encrypt the FSs with LUKS and provide
somehow the key at boot time and decrypt the FSs:
system-a/b, writable and swap. During this process I am
facing some problems which I need to solve asap:<br>
- The configured grub on the FS, apparently does not
belong to the real system. When I run update-grub from a
fresh installation does not appear the same menu options
than when booted before.<br>
- The "break=premount" parameter does not work<br>
- The kernel and initrd image are located in /boot but the
"boot" partition point to /boot/efi which I guess it will
be a problem when de rootfs is encrypted.<br>
As a solution, I guess it is better to move the kernel
+ initrd to /boot/efi. I will need to only update grub and
update-initramfs. Am I missing something?<br>
<br>
Best Regards,<br>
Xavi</blockquote>
</div>
</div>
</div>
<br>
</blockquote>
</body>
</html>