From nobody Mon Mar 13 05:45:43 2023 X-Original-To: questions@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4PZlxk1sVMz3yC6N for ; Mon, 13 Mar 2023 05:45:46 +0000 (UTC) (envelope-from ralf-mardorf@riseup.net) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "mx1.riseup.net", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4PZlxj2GyDz49Bs for ; Mon, 13 Mar 2023 05:45:45 +0000 (UTC) (envelope-from ralf-mardorf@riseup.net) Authentication-Results: mx1.freebsd.org; dkim=pass header.d=riseup.net header.s=squak header.b=EjiPhA0v; spf=pass (mx1.freebsd.org: domain of ralf-mardorf@riseup.net designates 198.252.153.129 as permitted sender) smtp.mailfrom=ralf-mardorf@riseup.net; dmarc=pass (policy=none) header.from=riseup.net Received: from fews1.riseup.net (fews1-pn.riseup.net [10.0.1.83]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "mail.riseup.net", Issuer "R3" (not verified)) by mx1.riseup.net (Postfix) with ESMTPS id 4PZlxg3y9hzDqCF for ; Mon, 13 Mar 2023 05:45:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1678686343; bh=9ruiDR9MIbfrkGv1R5efKMN25rRPkwzbCISjug/fWkg=; h=Subject:From:To:Date:In-Reply-To:References:From; b=EjiPhA0vvwCFzpgNjpp2QpcfURiKSRju33UPA5hMteIMk77EVcvTsOyPY9S+Cchvz iC5YPBxtVBS8Cc333mDhgoVR0gjbWc763aLCXLFDFwicP9fNoYAt7/I9F/A7cxSp9I CIuITTJDPG9a71N9mMe1tRvgOrkuAobT6S4anK5I= X-Riseup-User-ID: EDFF720671C0C4BE968254D573FA6E7774ABDB07233AA5BBB1EE682557EBD3AE Received: from [127.0.0.1] (localhost [127.0.0.1]) by fews1.riseup.net (Postfix) with ESMTPSA id 4PZlxf6j9qz5vY8 for ; Mon, 13 Mar 2023 05:45:42 +0000 (UTC) Message-ID: <14aa1e4595dee522437202d34d2e73614aa42bac.camel@riseup.net> Subject: Re: geli encryption on server From: Ralf Mardorf To: questions@freebsd.org Date: Mon, 13 Mar 2023 06:45:43 +0100 In-Reply-To: <20230312233648.15753eed.freebsd@edvax.de> References: <8ef427543f851a296b4a1804764f3f5ece48225d.camel@blues-softwares.net> <20230312233648.15753eed.freebsd@edvax.de> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable List-Id: User questions List-Archive: https://lists.freebsd.org/archives/freebsd-questions List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-questions@freebsd.org X-BeenThere: freebsd-questions@freebsd.org MIME-Version: 1.0 X-Spamd-Result: default: False [-4.20 / 15.00]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_SHORT(-1.00)[-1.000]; DMARC_POLICY_ALLOW(-0.50)[riseup.net,none]; R_DKIM_ALLOW(-0.20)[riseup.net:s=squak]; R_SPF_ALLOW(-0.20)[+mx]; MIME_GOOD(-0.10)[text/plain]; RCVD_IN_DNSWL_LOW(-0.10)[198.252.153.129:from]; RWL_MAILSPIKE_GOOD(-0.10)[198.252.153.129:from]; FROM_EQ_ENVFROM(0.00)[]; ARC_NA(0.00)[]; MLMMJ_DEST(0.00)[questions@freebsd.org]; MIME_TRACE(0.00)[0:+]; RCVD_TLS_ALL(0.00)[]; ASN(0.00)[asn:16652, ipnet:198.252.153.0/24, country:US]; TO_MATCH_ENVRCPT_ALL(0.00)[]; DWL_DNSWL_NONE(0.00)[riseup.net:dkim]; DKIM_TRACE(0.00)[riseup.net:+]; TO_DN_NONE(0.00)[]; PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; RCVD_COUNT_THREE(0.00)[3]; MID_RHS_MATCH_FROM(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[] X-Rspamd-Queue-Id: 4PZlxj2GyDz49Bs X-Spamd-Bar: ---- X-ThisMailContainsUnwantedMimeParts: N On Sun, 2023-03-12 at 23:36 +0100, Polytropon wrote: > However, you _can_ use this approach with storing the keyfile > on a USB stick and remove it when the system has been started. Since USB sticks are not reliable, backing up the key is required, but copies of keys lower security. While SanDisk Extreme PRO SD cards are reliable, I wouldn't trust the reliability. Btw. I already lost keys to decrypt emails out of sloppiness, IOW sometimes users aren't reliable, too. Not to mention that sometimes, though rarely, I don't know my bank card's 4-digit PIN at the supermarket checkout. Then I wish I had written them on the card ;D. Security measures are a double-edged sword. Useless when done wrong, but a pitfall when done right.