0

I have an external HD encrypted with luks. I would like it to automount on my home computer (using a key file stored at my $HOME directory) any time I plug it in (not necessarily at boot time) and ask for a password anywhere else. So, my device would have 2 keys.

Is it possible? How could I do it?

BTW, I'm using Devuan 2.0 if that matters.

2
  • Should this happen only at boot or login (when a ~/.config/autostart file might be easy to do), or anytime the external HD is plugged in? Where's the keyfile kept, somewhere in $HOME?
    – Xen2050
    Dec 30, 2018 at 22:49
  • Added the extra info you required at the main question.
    – Rsevero
    Dec 31, 2018 at 13:42

1 Answer 1

0

You may want to have a look at Network Bound Disk Encryption as provided by clevis and tang here: https://github.com/latchset.

Both are included in RHEL and CentOS starting from version 7.5. Please note that CentOS 7.6 broke automatic decryption for me (your mileage may vary).

2
  • This is an interesting concept. Thanks for your input. But it seems rather over engineered for my situation. I wonder if for a local workstation there is a simplier solution.
    – Rsevero
    Dec 31, 2018 at 15:01
  • Clevis also allows to decrypt a volume using encryption key stored in TPM (v 2.0 is required). This has been recently added to clevis in RHEL 7.6 and CentOS 7.6. And having a look at packages, especially udisks files may allow you to write your own code to achieve what you need with a file in $HOME.
    – Tomek
    Dec 31, 2018 at 16:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .