This is an alternative to manually typing your password to decrypt your home server disks.
The idea is that you have a Tang server somewhere on your local network. When your server boots up, it needs to communicate with the Tang server to unlock the disk. Tang doesn’t store the key and is stateless, but the client requires Tang’s cooperation to compute the key.
For me, I’m thinking about someone breaking into my house and stealing my computer. Currently, I have LUKS read a keyfile from a USB drive… but I almost always leave it plugged in… so a thief would probably accidentally steal that too.
With this setup, I’m thinking maybe I could setup a Pi on the opposite side of my house, ideally hidden. And then if my home server gets stolen, LUKS wouldn’t be able to reach my Tang server, and therefore not unlock anything.
If you have an openwrt compatible router then you can use that as the tang server.
Also you can tell clevis to use both tpm and tang and require both to work.
I use it on a server. The tang server is on my OpenWRT access point. Works great. As a backup, if unlocking fails or if tang is down, I can SSH into the server and manually enter a decryption key to unlock it.
I’m running Tang on a VPS, outside of my homelab. Servers in my homelab set up networking and a dedicated WireGuard tunnel to the VPS from initrd, to be able to talk to Tang, to help unlock the filesystem. The WireGuard tunnel is only allowed from my home ISP’s ASN. So if anyone picks up all my equipment from my homelab and walks away with them, they will not be able to boot them up, unless they connect from my ISP’s ASN (good luck), or know the passphrase.
Additionally, some of my homelab computers that support TPM also have a TPM pin, so walking away with the disk only, and connecting from my ISP’s ASN would still not be enough. This is rather pointless, anyone who walks away with the disk only will likely take the entire computer instead. But it was fun setting it up.
In the not so distant future, I’ll update this setup to use Shamir Secret Sharing more, where I’ll have three pins: my VPS (via Wireguard), a small computer somewhere else in my apartment, and a third at a neighbour (+ TPM on supporting computers).
I’ll update this setup to use Shamir Secret Sharing more, where I’ll have three pins: my VPS (via Wireguard), a small computer somewhere else in my apartment, and a third at a neighbour (+ TPM on supporting computers).
Cool!
You could also mount a NFS share on boot where a keyfile is stored. No extra service needed.
The benfit of tang is that you don’t store the secret on a shared server.
The server has a single keypair that it reuses for every client, and each client has thier own keypair.
The encryption key can only be recovered when the client and server perform thier handshake. And only the client gets the key, the server cannot see it.
I used to use them, yes. It’s a pretty solid setup, especially like you say, if the tang server itself requires you enter a password to unlock.
A while ago I moved to tpm and secureboot to auto-unlock my servers on boot. It’s definitely slightly less secure, tpm vulnerabilities or a severe enough vulnerability in one of the network services on the machine and a hacker could get into them. But it’s quite a bit more secure than storing the unlock key on usb, and requires at least some degree of hacking skill to break in.
sbctl makes the process of signing boot files pretty easy, systems-cryptenroll for setting up tpm auto-unlock
Dropbear allows you to remotely unlock LUKS over SSH
Manually sure. Tang and clevis is automagic
Interesting. Never heard of Clevis & Tang. I just type the passphrase in on boot for the LUKs drives, and the same for anything Bitlocker. So, I guess they’d have to get the ol’ pipe wrench out.
I just have a KVM that I can unlock LUKS with remotely.
I can access it remotely as my router has a built in Wireguard server so I connect to that and I’m basically on LAN.
What’s a KVM? I thought that was a kernel virtual machine, but it seems to mean something else.
Keyboard, video, mouse
Its just another computer remotely accessible that is connected to those ports on whatever you want to monitor. For example, used to enter bios on remote devices
Is it a special device? How does it send signals for mouse and keyboard? Via some USB protocol? And how is the video transfered?
