January 2, 20251 yr Hi there. Before I dive too deep into this: what are your thoughts about feasibility of this idea? Automatically de-crypt a whole zfs-pool through a go-script that checks if a YubiKey usb key is present. The steps I had in mind roughly: Create a LUKS key file and encrypt it with GPG using a public key whose private key resides on the YubiKey Store the GPG-encrypted file on Unraid flash drive Use a startup script to copy and decrypt key requiring the YubiKey to be present Delete decrypted key copy so that the pool remains unlocked, but cannot be re-unlocked if the YubiKey isn’t available First of all, what do you think? Bananas? If not, how would you implement the Unraid specific part (step 3)? I assume doing this for a whole zfs pool a script in /boot/config/go must be required, so that it happens before the array starts? Any other thoughts or recommendations? Edited January 2, 20251 yr by stahlblau
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.