Re: FAQ 2.2 Scenario (1) - clarification concerning "encrypted root"

I think I can get secure boot working so that the system will not boot unless the kernel and initrd match sign d files

On Jun 20, 2020 4:53 PM, Arno Wagner <[email protected]> wrote:

This critically depends on the initrd being non-manipulated.&#13;

Of course, you cannot use the initrd to verify a signature &#13;

on the initrd securely ...&#13;

&#13;

Regards,&#13;

Arno&#13;

&#13;

On Sat, Jun 20, 2020 at 19:26:32 CEST, JT Morée wrote:&#13;

> I'm working through a setup right now and documenting at&#13;

> https://sites.google.com/site/jtmoree/knowledge-base/smart-cards-and-linux/kubuntu-20-04&#13;

> &#13;

> I am using the smartcard to unlock root during the boot process. this is&#13;

> done by the kernel and initrd using out of the box tools and processes. &#13;

> &#13;

> in this setup /boot is in the clear and I have some ideas for signing the&#13;

> kernel+initrd with the smart card, then verifying on boot. will update&#13;

> the link if I get that working.&#13;

> &#13;

&#13;

-- &#13;

Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: [email protected]&#13;

GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718&#13;

----&#13;

A good decision is based on knowledge and not on numbers. -- Plato&#13;

&#13;

If it's in the news, don't worry about it. The very definition of &#13;

"news" is "something that hardly ever happens." -- Bruce Schneier&#13;

_______________________________________________&#13;

dm-crypt mailing list&#13;

[email protected]&#13;

https://www.saout.de/mailman/listinfo/dm-crypt&#13;

_______________________________________________
dm-crypt mailing list
[email protected]
https://www.saout.de/mailman/listinfo/dm-crypt