I'm trying to solve what appears to be a chicken-and-egg problem. When a machine appears on my network, how do I know that it is whom it asserts to be?

Suppose, for instance, the host has an encrypted filesystem to hold data - if I put the passphrase in a local (unencrypted) filesystem, then both the passphrase and encrypted data may appear in the same backup.

Using certificates or a shared secret is commonly used to identify machines across a network - but again there is a problem of persistence.

Booting the system to an interim state, awaiting manual injection of a passphrase would be one way to address this - but introduces significant delays.

Using the hosts mac address (leaving aside the lack of entropy) won't work very well with virtual machines on a farm of vm hosts, nor across a router.

While I've used browser fingerprinting as an indicator of identity elsewhere, to what extent can this be applied to a whole host?

Does anyone have better or complementary suggestions?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.