When running a fully encrypted linux system using dm-crypt, the /boot
partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a pre-boot ssh server that is running from initrd.
One attack vector I'd like to close is installing a keylogger in the initrd.
I reasoned like this:
I cannot prevent changes to the /boot
partition as the adversary has access to it in a hosted environment. But I can detect changes using checksums from within the encrypted system using simple sha512sum or tripwire. Also I can monitor the server for reboot (which might indicate changes).
What mitigation methods come to your mind?