←back to thread

Apple: SSH and FileVault

(keith.github.io)
507 points ingve | 4 comments | 18 Sep 25 20:15 UTC | HN request time: 0.736s | source
Show context
pfexec ◴[18 Sep 25 21:37 UTC] No.45295315[source]▶
Friendly reminder that you've been able to automatically unlock fully-encrypted Linux systems via TPM for years since it was added to systemd...

(Here's a nickel kid...)

replies(7): >>45295330 #>>45295407 #>>45295507 #>>45295760 #>>45295936 #>>45299627 #>>45311400 #
1. rnhmjoj ◴[18 Sep 25 21:45 UTC] No.45295407[source]▶
Also possible without a TPM: you just put openssh into the initrd, so you can log in and type the password to unlock the root.

(It's technically not full-disk encryption because the kernel and initrd are in plaintext, but everything else is)

replies(1): >>45295435 #
2. pfexec ◴[18 Sep 25 21:48 UTC] No.45295435[source]▶
What do you authenticate against? Your shadow file is in the unencrypted area leaving it susceptible to offline attack.

With the TPM you can fully disable password auth over SSH.

replies(2): >>45295467 #>>45299124 #
3. rnhmjoj ◴[18 Sep 25 21:52 UTC] No.45295467[source]▶
Correct, someone with physical access could run a MitM attack and steal your passphrase. I just find this extremely unlikely, so I honestly don't care.
4. auguzanellato ◴[19 Sep 25 08:03 UTC] No.45299124[source]▶
My Raspberry Pi some time ago had a setup where only public key auth was enabled for LUKS unlock, so I only had to have an authorized_keys file unencrypted.