Re: Getting GELI Keys from Floppy

On Thursday 07 September 2006 00:00, Frank Steinborn wrote:
Hello,

i want to encrypt my HDD's with GELI (not the root-fs, though). I want
to do the encryption without password, just with a key. The key should
be stored in a floppy disk, and the read should be read automatically
on boot, from the floppy.

Are you sure you want to trust a floppy disk for your keys??
It's not the most safe medium these days...


There is a problem here, because GELI initializes _before_ mounting
the disks from /etc/fstab (for obvious reasons, of course). So GELI is
not able to get the keys from the floppy and fails.

So, any hints how I could get the floppy mounted _before_ GELI tries
to initialize?

Why don't you use the plain device(/dev/fd0) instead of using a file on a
filesystem on the floppy? I think there are examples in the manual page.

Anyway, I find this a very very bad idea. If the floppy break in some way
you're gonna be in big trouble...
_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: Getting GELI Keys from Floppy
    ... i want to encrypt my HDD's with GELI ... on boot, from the floppy. ... Are you sure you want to trust a floppy disk for your keys?? ... because GELI initializes _before_ mounting ...
    (freebsd-questions)
  • Getting GELI Keys from Floppy
    ... i want to encrypt my HDD's with GELI ... on boot, from the floppy. ... because GELI initializes _before_ mounting ...
    (FreeBSD-Security)
  • Getting GELI Keys from Floppy
    ... i want to encrypt my HDD's with GELI ... on boot, from the floppy. ... because GELI initializes _before_ mounting ...
    (freebsd-questions)
  • Re: Getting GELI Keys from Floppy
    ... You want to protect your data with a key stored on the most completely and utterly unreliable form of data storage still lamentably in use? ... You'll want to then use "geli -K" to input your key material, so you'll want to make sure your device is present, and that it has the expected key filename on it. ... on boot, from the floppy. ... because GELI initializes _before_ mounting ...
    (FreeBSD-Security)
  • Re[2]: GELI - FreeBSD Full Disk Encryption
    ... GELI even properly installed has some security problems, ... linked to a FreeBSD Full Disk Encryption Howto video.. ... to do the encryption without password, ... on boot, from the floppy. ...
    (FreeBSD-Security)