[DOCUMENTATION NEEDED] [REVIEW NEEDED] feat: implement tpm sealed sshd host keys #89
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Hm, I don't have any experience with tpm and the sealing of files, thus, I can't review it right now. Is this something that could live orthogonal to dracut-sshd in a separate dracut module? |
|
possible, but i have precisely 0 experience in writing dracut modules or
RPMs
…On Sun, Jan 5, 2025, 17:23 Georg Sauthoff ***@***.***> wrote:
Hm, I don't have any experience with tpm and the sealing of files, thus, I
can't review it right now.
Is this something that could live orthogonal to dracut-sshd in a separate
dracut module?
—
Reply to this email directly, view it on GitHub
<#89 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ANT4ZCNOJBXST2H73XPN5WL2JE57FAVCNFSM6AAAAABURZBFB6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKNZRGY2DIMBTGA>
.
You are receiving this because you authored the thread.Message ID:
***@***.***>
|
|
also, you probably want edit: this doesnt work |
|
alright, i got it working in a separate module, and published it on my forgejo. thank you! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
this allows one to verify cryptographically that the initramfs has NOT been modified, and prevents attackers from doing a MITM attack or inserting a keylogger into the initramfs. the key can not be read without booting the machine, and if you modify the initramfs, the key wont be released.
this implementation is somewhat sloppy, as i just need it for my desktop and server right now. even though it passes the tests, please review thoroughly before merging.