I have an application that requires unattended decryption of files/folders.

Would it be possible to utilize the hash of the root password to prevent an attack where a malicious user changes the root password and then boots into the machine?

Encryption method has not yet been determined, but this "derived password" would be used with per-file encryption (perhaps via PGP) or folder based encryption with something like encFS or eCryptfs.

Context: I've been trying to get unattended booting w/ FDE to work via my TPM chip but this isn't working out very well for me with Debian Jessie, so I had this idea and thought this could potentially prevent a user from changing the root password and then looking at the key files used to unlock the folders or files.

  • Before they manage to change the root password, couldn't they just copy the current hash out of the passwd file or wherever its stored for verification purposes? – user2813274 Jul 9 '16 at 5:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.