Arch Linux

ice9.8char

Member

Registered: 2021-09-30

Posts: 1

3FA Raid 6 System Setup & Offsite Backup Encrypted w/NtruEncrypt

3FA I thought 2FA was plenty...

Hi all, the name's Marcus. First install and setup of arch 3 years ago went "smoothly" (smooth enough), I have had this bug up and have been wanting to try this for a while. Had some money burning a whole so here is a spec list of everything I just bought, just in case anyone's interested:

Dell R720, 2 x Xeon 10C 20T 3.0Ghz base, 32G 4x8 DDR3 Registered-ECC 1600Mhz
10 x 1tb WD Sata SSD
NV Quadro K5200
NV GTX 1660 Super
256Gb NVMe M.2 m-key with a cheap $10 m-key m.2 to PCIe 4x adapter card

120Gb USB 3.0 stick with the archiso os on the internal USB header (won't exist in final setup)

I am open to any and all criticism/comments as long as they are in a constructive/helpful manner...
Just because you may deem it useless, doesn't mean someone else wont find this in the future with a similar idea, because for them I wish for my dumb questions to be answered so they wont have to ask them in the future.

With that said, here is my extensive battle plan (everything is how I want it setup (otherwise noted) in the final config):

3FA - cryptdisk, google auth GA (or something else open source GAa (GA Alternative)), multiple Unique PAK's (physical auth keys, ie like a smart card) to which must be physically attached to the server and mounted for booting with their own unique passphrases (order undetermined, excluding sda6 crypt will be the last boot auth to occur)

Some sort of stupid small os that runs on boot, (refered to herefor "SSOS") preferably read-only, to which I can ssh in from another device on my home network. For authentication I want 2 Unique PAKs, one main one backup just in case the main one breaks except they don't have to have unique unlocking passphrases, they just need to be inserted and mounted allowing the os to detect this and start the ssh daemon, then just the basic using required GA/GAa first and then some generic low privilege user's unix password, upon auth I want either terminal access or direct execution of a script (either way the script can be run) I want the script to simply ask the user for a final password to which it simply hands the password to whatever PAK is inserted, the master key is decrypted in ram and if this is all done correctly it asks you for another GA/GAa code and then simply passes the decrypted key to crypt and the aarch64 os is unlocked and the system somehow kills the SSOS and hands execution to the newly decrypted os.

Here's a few kickers,

I want a toggleable tor tunnel to funnel all server traffic with some always exceptions like a backdoor port that leads to a multiplexer like sslh for events where if I am out and on a network that blocks things like ssh and sftp outbound traffic, I can just use the multiplexer port and connect through ssh the same exact way...

I also am getting a faster 512Gb m.2 ssd that I plan to use to hold vm disks, I need also somehow for the final OS to handle the decrypting and mounting of this drive as I plan to have scripted on boot virtual OS's doing various tasks...

The level of encryption I want on both ssh's (the SSOS and the main OS), and the main OS partition encryption is NTRUEncrypt. Whatever I have to do to recompile anything to apply libntru (a c impl. of NTRUEncrypt) - Here I could use THE MOST guidance. 9+ years coding in C and C++, I understand the functionality just not so much the placement (ie. section in ssh or cryptsetup I would have to recompile with the additional code).

Both OS's will have a DNS bind daemon running for my home website, so IP Address's wont be any issue whether or not the main OS is decrypted or not...

Extra points if you can help me find a way to have it regularly update everything (obv. without breaking itself)
You can win the damn game if you can help figure out the exact same solution but for an offsite backup. One where the offsite backup system has a connection scheme where when a file gets changed on the main server, it instantly updates via symbolic references so accidentally deleted files can be recovered with ease.
I am aware this will be a big project. I am ready for it. I would love for some assistance on where exactly to even start with this whole thing...

Now if I am totally out in left field and this forum can NOT help me, I would gladly take some redirection to somewhere I could get assistance with this project...

Anyways,
Cheers!

Last edited by ice9.8char (2021-10-01 11:20:45)

loqs

Member

Registered: 2014-03-06

Posts: 18,996

Re: 3FA Raid 6 System Setup & Offsite Backup Encrypted w/NtruEncrypt

Shopping list threads are not encouraged as they rarely work well and the mixing of topics makes much harder for others to benefit from the information.  General_guidelines#How_to_post

The level of encryption I want on both ssh's (the SSOS and the main OS), and the main OS partition encryption is NTRUEncrypt. Whatever I have to do to recompile anything to apply libntru (a c impl. of NTRUEncrypt) - Here I could use THE MOST guidance. 9+ years coding in C and C++, I understand the functionality just not so much the placement (ie. section in ssh or cryptsetup I would have to recompile with the additional code).

Why NTRU for disk encryption what threat is that addressing that AES is vulnerable to?
For ssh have you looked at https://github.com/open-quantum-safe/openssh you would also need a portable version of it on each client.  Please do see the warnings that both the algorithms including NTRU and the implementation are not considered safe for production use.