While setting up a new NixOS server VM, I’d like to take that as an opportunity to finally encrypt my data with LUKS/ dm-crypt.
As I don’t have physical access to its host machine, probably asking for the password at each boot is the way to go.
Is anyone already using such a setup? To avoid downtime in case of an unattended reboot, I’d like to be notified about the need of entering a password.
For both security and simplicity reasons, it’d be nice to put the disk unlock process as early into the boot process as possible. One popular approach seems to be including dropbear as a light-weight SSH server into the initramfs and then unlock via that. Does anyone have a configuration for that?
I run such a setup with dropbear. It’s quite easy to configure:
# additional hardware configuration not discovered by hardware scan
boot.initrd.availableKernelModules = [ "virtio-pci" ];
boot.initrd.network = {
enable = true;
ssh = {
enable = true;
port = 2222;
hostECDSAKey = /var/src/secrets/dropbear/ecdsa-hostkey;
# this includes the ssh keys of all users in the wheel group, but you can just specify some keys manually
# authorizedKeys = [ "ssh-rsa ..." ];
authorizedKeys = with lib; concatLists (mapAttrsToList (name: user: if elem "wheel" user.extraGroups then user.openssh.authorizedKeys.keys else []) config.users.users);
};
postCommands = ''
echo 'cryptsetup-askpass' >> /root/.profile
'';
};
Since the ssh server in initrd will use a different hostkey (it’s unencrypted), I always let it listen on a different port, so that the ssh client will not complain about the different host key.
Also note that the initrd networking will automatically include dhcp for the interfaces where you have enabled it (with networking.interfaces.xyz.useDHCP).
Just be aware that the networking from initrd is kept, and predictable interface names and IPv6 configuration might not work as expected.
Thx @petabyteboy. Especially the remarks about the postCommands and the host keys are very helpful.
Do you rely on external monitoring for learning about unexpected reboots? Otherwise one would need to put a notification toll into the initramfs as well.
This server is hosting my mail and all the other stuff, so I will notice it when I take a look at my phone and Conversations complains about not being able to reach the XMPP server.
But to be honest I have not had any unexpected reboots since I set this up a few months ago, what would cause the server to reboot?
what would cause the server to reboot?
In case of my VMs on a shared host server, someone rebooting for a kernel update without announcing it to me.
In case of servers at home, power cuts do happen sometimes.
Is it possible to re-configure the interface after initrd?
While I do not care about the interface name, I only supplied a static IPv4 config via the kernel cmdline ip= parameter, resulting in the lack of an IPv6 address after bootup although it is configured in my configuration.nix.
Why doesn’t the interface reconfigure during the init bootup? How does it recognise its existing configuration, maybe it could be reset after entering the password?
Have you supplied the predictable network interface name of your interface as the 6th argument where @apeyroux wrote eno1? Your device probably has a different name.
Is it possible to just test this new initrd module or do I need to rebuild my whole system from the nixpkgs branch?
I’m a bit reluctant to rebuild my whole stable system from an unstable branch as I don’t know how that affects my stateful storage data (DBs, application state).
I’ve cherry-picked the commits on top of the current release-19.09 branch and checked that the relevant tests still pass. Pushed to https://github.com/NixOS/nixpkgs/tree/fix-predictable-ifnames-in-initrd-19.09 so you could test with nixpkgs=https://github.com/NixOS/nixpkgs/archive/fix-predictable-ifnames-in-initrd-19.09.tar.gz in your NIX_PATH.
After some research, and the use of unstable (dropbear to openssh), i found a way to correctly config hostkey to connect with ssh and decrypt luks remotly :
Something i don’t understand is why the passphrase is asked only one time. Normally if boot is encrypted, doc indicate that passphrase is needed two times.
