/mandos/trunk : revision 178

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to README

Committer: Teddy Hogeborn
Date: 2008-09-07 15:42:11 UTC
Revision ID: teddy@fukt.bsnet.se-20080907154211-sc90y38lazc4ewfq

* initramfs-tools-script: Fix permissions of "/tmp" in initrd.

* plugin-runner.c (parse_opt): Ignore empty argument strings.

Show diffs side-by-side

added added

removed removed

README

* Mandos

- Have your cake and eat it too!

You know how it is. You’ve heard of it happening. The Man comes

and takes away your servers, your friends’ servers, the servers of

You know how it is. You've heard of it happening. The Man comes

and takes away your servers, your friends' servers, the servers of

everybody in the same hosting facility. The servers of their

neighbors, and their neighbors’ friends. The servers of people who

owe them money. And like *that*, they’re gone. And you doubt

you’ll ever see them again.

neighbors, and their neighbors' friends. The servers of people who

owe them money. And like *that*, they're gone. And you doubt

you'll ever see them again.

That is why your servers have encrypted root file systems. However,

there’s a downside. There’s no going around it: rebooting is a

there's a downside. There's no going around it: rebooting is a

pain. Dragging out that rarely-used keyboard and screen and

unraveling cables behind your servers to plug them in to type in

that password is messy, especially if you have many servers. There

have to be on hand and manually type in the password at boot time.

Otherwise the server just sits there, waiting for a password.

Wouldn’t it be great if you could have the security of encrypted

Wouldn't it be great if you could have the security of encrypted

root file systems and still have servers that could boot up

automatically if there was a short power outage while you were

asleep? That you could reboot at will, without having someone run

Now, of course the initial RAM disk image is not on the encrypted

root file system, so anyone who had physical access could take the

Mandos client computer offline and read the disk with their own

tools to get the authentication keys used by a client. *But*, by

then the Mandos server should notice that the original server has

been offline for too long, and will no longer give out the encrypted

key. The timing here is the only real weak point, and the method,

frequency and timeout of the server’s checking can be adjusted to

any desired level of paranoia

server offline and read the disk with their own tools to get the

authentication keys used by a client. *But*, by then the Mandos

server should notice that the original server has been offline for

too long, and will no longer give out the encrypted key. The timing

here is the only real weak point, and the method, frequency and

timeout of the server’s checking can be adjusted to any desired

level of paranoia

(The encrypted keys on the Mandos server is on its normal file

system, so those are safe, provided the root file system of *that*

to do. An attacker would have to physically disassemble the client

computer, extract the key from the initial RAM disk image, and then

connect to a *still online* Mandos server to get the encrypted key,

and do all this *before* the Mandos server timeout kicks in and the

Mandos server refuses to give out the key to anyone.

all *before* the Mandos server timeout kicks in and the Mandos

server refuses to give out the key to anyone.

Now, as the typical procedure seems to be to barge in and turn off

and grab *all* computers, to maybe look at them months later, this

is not likely. If someone does that, the whole system *will* lock

Now, as the typical SOP seems to be to barge in and turn off and

grab *all* computers, to maybe look at them months later, this is

not likely. If someone does that, the whole system *will* lock

itself up completely, since Mandos servers are no longer running.

For sophisticated attackers who *could* do the clever thing, *and*

129

focused, and competent attacks, but against the early morning knock

130

on your door and the sudden absence of all the servers in your

131

server room. Which it does nicely.

132

133

* Copyright

134

135

136

2008 Björn Påhlsson

137

138

** License:

139

140

This program is free software: you can redistribute it and/or

141

modify it under the terms of the GNU General Public License as

142

published by the Free Software Foundation, either version 3 of the

143

License, or (at your option) any later version.

144

145

This program is distributed in the hope that it will be useful, but

146

WITHOUT ANY WARRANTY; without even the implied warranty of

147

MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

148

General Public License for more details.

149

150

You should have received a copy of the GNU General Public License

151

along with this program. If not, see

152

<http://www.gnu.org/licenses/>.

Older »