Obfuscation of initramfs

jussihi · 2019-04-12 09:07:46

Hello,

Is there any way to obfuscate/hide a file on the initramfs or do it for the whole initramfs image? I have an encrypted filesystem which is decrypted by a key file on the initramfs, but as told in the wiki (https://wiki.archlinux.org/index.php/Dm … _initramfs), it is not that secure, as anyone can just extract my initramfs with the lsinitcpio and hence get the key file from the image.

Now, is there any way to obfuscate the key file into the initramfs? I thought about creating an executable in C that does same commands as the mount-hook that mounts crypted drives, and calls those functions with the key file embedded in the executable (obfuscated, of course). This would make cracking open the filesystem even a little harder.

Are there any better solutions for my needs?

Thanks in advance!

frostschutz · 2019-04-12 09:16:37

Simple obfuscation will not work, you can always explore the initramfs. Basically you have to come up with your own solution.

My (desktop) initramfs has a keyfile but it's encrypted with a password. So both keyfile and typed in passphrase are necessary and a simple keylogger alone is not sufficient.

My (server) initramfs has no keyfile but it generates the key on the fly as a hash of CPU, RAM, MAC-Address, and a random known salt. That way whoever gets a copy of the initramfs also needs to know the hardware specs... so simply taking the hard drive out of the server does not work.

But neither of these protect against any other attacks (online or hands-on access to hardware). It's the price you pay for allowing a server to come back online on its own without outside help.

Last edited by frostschutz (2019-04-12 09:20:46)

jussihi · 2019-04-12 13:45:15

frostschutz wrote:

Simple obfuscation will not work, you can always explore the initramfs. Basically you have to come up with your own solution.
My (desktop) initramfs has a keyfile but it's encrypted with a password. So both keyfile and typed in passphrase are necessary and a simple keylogger alone is not sufficient.
My (server) initramfs has no keyfile but it generates the key on the fly as a hash of CPU, RAM, MAC-Address, and a random known salt. That way whoever gets a copy of the initramfs also needs to know the hardware specs... so simply taking the hard drive out of the server does not work.
But neither of these protect against any other attacks (online or hands-on access to hardware). It's the price you pay for allowing a server to come back online on its own without outside help.

Thanks for the quick reply!

I need to have it automatically input the password (just like your server), but the machine might change, so I think I need to create my own solution for this

seth · 2019-04-12 14:07:05

https://wiki.archlinux.org/index.php/Dm … _partition ?
Depending on your requirements you could also download the key and limit the upload to certain IP(-range)s on the other side.

frostschutz · 2019-04-12 15:00:43

jussihi wrote:

I need to have it automatically input the password (just like your server), but the machine might change, so I think I need to create my own solution for this

With LUKS you can naturally change the key in that case. Changing key works by setting a standard passphrase before rebooting and will then be changed during the boot process.

I posted my self decrypting server before in Gentoo Wiki (Custom Initramfs Examples) or for ArchLinux here https://gist.github.com/frostschutz/ca4 … 3cd83c78fe

please take it with a grain of salt, this example is not entirely stable across kernel versions either. but it should demonstrate the idea.

also for mac address to be known in initramfs, the relevant network modules must be added / loaded.

Last edited by frostschutz (2019-04-12 15:01:41)

Arch Linux

#1 2019-04-12 09:07:46

Obfuscation of initramfs

#2 2019-04-12 09:16:37

Re: Obfuscation of initramfs

#3 2019-04-12 13:45:15

Re: Obfuscation of initramfs

#4 2019-04-12 14:07:05

Re: Obfuscation of initramfs

#5 2019-04-12 15:00:43

Re: Obfuscation of initramfs

Board footer