Idea: Unlock remote machine via SSH

[Frederick888]

This is a proof of concept which contains a lot of ugly hacks and it's not intended to be merged.

I would like to use yubikey-full-disk-encryption to unlock a headless machine without the hassle of unplugging/plugging YubiKey. So inspired by the encryptssh hook from mkinitcpio-utils I'm using currently, here's a prototype that utilises SSH port forwarding to achieve this job.

Server-Side Requirements

1. nc from gnu-netcat
2. ss from iproute2
3. a patched mkinitcpio-dropbear (contains an upstream dss fix and a minor change to allow port forwarding)

dropbear (and netconf) needs to be pre-configured according to https://wiki.archlinux.org/index.php/Dm-crypt/Specialties#Remote_unlocking_(hooks:_netconf,_dropbear,_tinyssh,_ppp).

mkinitcpio hooks should look like:

HOOKS=(base udev autodetect keyboard keymap modconf block netconf dropbear ykfde filesystems fsck)

Client-Side Requirements

1. ncat from nmap
2. ykfde-ssh from this PR

Basically what it does is

1. Server fires up network and dropbear
2. Client uses ykfde-ssh Hostname and it:
   1.1 starts ncat to listen on 127.0.0.1:9000 and wait for the challenge
   1.2 forwards 127.0.0.1:9000 to Server
3. Server uses ss to detect whether 127.0.0.1:9000 is open
4. Server uses nc to send the challenge to 127.0.0.1:9000 and obtains the response

I've tested it in a virtual machine and it seems to work pretty smoothly. However the configuration does tend to be overly complex and I actually wonder whether there is a better way of doing this rather than using SSH port forwarding. But @agherzan if you feel comfortable about this idea I can then make some time to tidy it up and submit a proper PR.

[Vincent43]

This is interesting functionality, thank you. I'm not able to test it in any way but left few comments.

The final form would need some info in README too.

[Vincent43]

Could you make shebang consistent with other ykfde-* scripts? We use #!/bin/bash -p elsewhere.

[Vincent43]

This ykchalresp invocation leaks challenge, see #44 and how it was fixed.

Also this line triggers following shellcheck warning:

In ykfde-ssh line 3:
ncat -c 'read challenge; /bin/ykchalresp -2 "$challenge";' -l 9000 &
        ^-- SC2016: Expressions don't expand in single quotes, use double quotes for that.

For more information:
  https://www.shellcheck.net/wiki/SC2016 -- Expressions don't expand in singl...

[AmShaegar13]

I am pretty sure that this is single quoted intentionally.

[agherzan]

Yes - it was to avoid expand. But if that is the case, a comment and a shellcheck disable should be added.

[Vincent43]

I think those two should depend on "$YKFDE_SSH"

[agherzan]

Shall we close this PR for now?

[Frederick888]

Ah, sorry, got busy for a while then completely forgot about this. I still would like to finish this feature, but I can't give you a time frame right now. Is it ok? Or I'm also happy to submit another PR when I actually manage to wrap it up.

[Vincent43]

Take your time, we can wait 😄

[agherzan]

That's absolutely alright. Just wanted to make sure it's still planned sometime in the future.

[Piraty]

https://github.com/dracut-crypt-ssh/dracut-crypt-ssh/ does that