19.3. Using volume_key in a larger organization
volume_keycan use asymmetric cryptography to minimize the number of people who know the password required to access encrypted data on any computer.
19.3.1. Preparation for saving encryption keys
Procedure 19.3. Preparation
- Create an X509 certificate/private pair.
- Designate trusted users who are trusted not to compromise the private key. These users will be able to decrypt the escrow packets.
- Choose which systems will be used to decrypt the escrow packets. On these systems, set up an NSS database that contains the private key.If the private key was not created in an NSS database, follow these steps:
- Store the certificate and private key in an
/the/nss/directory-NAt this point it is possible to choose an NSS database password. Each NSS database can have a different password so the designated users do not need to share a single password if a separate NSS database is used by each user.
- Distribute the certificate to anyone installing systems or saving keys on existing systems.
- For saved private keys, prepare storage that allows them to be looked up by machine and volume. For example, this can be a simple directory with one subdirectory per machine, or a database used for other system management tasks as well.
19.3.2. Saving encryption keys
/path/to/volumeis a LUKS device, not the plaintext device contained within;
blkid -s typeshould report
Procedure 19.4. Saving encryption keys
- Save the generated
escrow-packetfile in the prepared storage, associating it with the system and the volume.
19.3.3. Restoring access to a volume
Procedure 19.5. Restoring access to a volume
- Get the escrow packet for the volume from the packet storage and send it to one of the designated users for decryption.
- The designated user runs:
volume_key --reencrypt -d
/the/nss/directoryescrow-packet-in -o escrow-packet-outAfter providing the NSS database password, the designated user chooses a passphrase for encrypting
escrow-packet-out. This passphrase can be different every time and only protects the encryption keys while they are moved from the designated user to the target system.
- Obtain the
escrow-packet-outfile and the passphrase from the designated user.
- Boot the target system in an environment that can run
volume_keyand have the
escrow-packet-outfile available, such as in a rescue mode.
/path/to/volumeescrow-packet-outA prompt will appear for the packet passphrase chosen by the designated user, and for a new passphrase for the volume.
- Mount the volume using the chosen volume passphrase.
cryptsetup luksKillSlot, for example, to free up the passphrase slot in the LUKS header of the encrypted volume. This is done with the command
cryptsetup luksKillSlot device key-slot. For more information and examples see
19.3.4. Setting up emergency passphrases
volume_keycan work with passphrases as well as encryption keys.
passphrase-packet. It is also possible to combine the
-ooptions to generate both packets at the same time.
volume_key --secrets -d