I'm trying to solve what appears to be a chicken-and-egg problem. When a machine appears on my network, how do I know that it is whom it asserts to be?
Suppose, for instance, the host has an encrypted filesystem to hold data - if I put the passphrase in a local (unencrypted) filesystem, then both the passphrase and encrypted data may appear in the same backup.
Using certificates or a shared secret is commonly used to identify machines across a network - but again there is a problem of persistence.
Booting the system to an interim state, awaiting manual injection of a passphrase would be one way to address this - but introduces significant delays.
Using the hosts mac address (leaving aside the lack of entropy) won't work very well with virtual machines on a farm of vm hosts, nor across a router.
While I've used browser fingerprinting as an indicator of identity elsewhere, to what extent can this be applied to a whole host?
Does anyone have better or complementary suggestions?