I run a small computer with an encrypted data partition. So that I have as little effort as possible to decrypt the hard disk after a reboot (no extra ssh login, password input etc.), I thought about storing the KeyFile on a small Raspberry Zero in the local network in an encrypted container. The Raspberry runs 247 and mounts the encrypted container to /mnt/KeyStore/. As soon as the computer boots, it fetches the KeyFile from the Raspberry, decrypts and mounts the data partition, and then destroys the KeyFile. The decryption process is so dependent on the Raspberry.
I have added a working sample code.
# Load SSH Agent and add Keys eval `ssh-agent -s -t 5m` ssh-add -t 5m /root/.ssh/*.prv # Create RamFS [[ -d /root/myramfs ]] || mkdir /root/myramfs mount ramfs /root/myramfs/ -t ramfs # Get the KeyFile from the KeyStore scp email@example.com:/mnt/keyStore/keyFile /root/myramfs/keyFile # Decrypt the device cryptsetup open /dev/sda1 storage --key-file /root/myramfs/keyFile # Remove the KeyFile and close the RamFS memory shred --remove --zero /root/myramfs/keyFile umount /root/myramfs # Mount the device mount /dev/mapper/storage /mnt/storage -o noatime,defaults
Are there any improvements or concerns?