[Feature] Stateless key

[AngryJKirk]

I am researching a secure and easy way to unlock my home server.

This thing is cool, but if my home server gets stolen it will be pretty much the same effect if I had no encryption at all.

Would be cool to improve the project so server would await during the boot for a password to be entered on a remote machine.

It would eliminate the security risk and make it more or less easy-to-use

(I am not asking you to implement this, but maybe some day some folk come across this repo and decides that it is a good idea to implement :D )

[Aterfax]

This functionality already exists with the dropbear-initramfs package (which we bootstrap as part of this project).

See: https://www.cyberciti.biz/security/how-to-unlock-luks-using-dropbear-ssh-keys-remotely-in-linux/

Edit:

This thing is cool, but if my home server gets stolen it will be pretty much the same effect if I had no encryption at all.

This is indirectly discussed in my security tips section:

Ideally your chosen web server machine has extremely strong encryption of its own, for example requiring manual, on site, 2 factor decryption via a Yubikey e.g. https://github.com/cornelinux/yubikey-luks

In such a setup (assuming you are hosting your own encrypted LAN webserver) unless your burglar is power splicing your bastion webserver as they steal it (which may be a concern if it is a letter agency) this would not be a concern as the webserver would get turned off and require decryption.

These issues are left to the imagination of the user / admin (and I am not going to implement anything along these lines). It is entirely upon the user/administrator to understand their needs an implement security safeguards for their situation.

e.g. things that come to mind:

• a LAN only webserver.
• an encrypted webserver.
• a encrypted webserver host equipped with GPS and geofencing to auto power off if moved.
• a encrypted webserver host equipped with a wifi card monitoring surrounding public wifi hotspots to geofence and auto power off if moved.
• a encrypted webserver host equipped with a dead man's switch of some type to power it off.
• a encrypted webserver host equipped with a geofencing and dead man's switch method and thermite charge over its storage.