Co-locating Debian Bullseye with an evil maid
In order to facilitate the secure co-location of a server, I looked into protecting a Debian Bullseye system from evil maid attacks. In addition, since I've enjoyed using ZFS for some time, I decided to rely on a natively encrypted ZFS root file system. Basically... I'd like to take a system containing sensitive information, box it up, and drop it in the mail without worrying about losing it or having it wind up in the wrong hands. A couple of things became clear while researching how to do this. First, there should be little chance that a rogue data-center admin can insert malicious…
What it does
In the maker’s words, at launch
In order to facilitate the secure co-location of a server, I looked into protecting a Debian Bullseye system from evil maid attacks. In addition, since I've enjoyed using ZFS for some time, I decided to rely on a natively encrypted ZFS root file system. Basically... I'd like to take a system containing sensitive information, box it up, and drop it in the mail without worrying about losing it or having it wind up in the wrong hands. A couple of things became clear while researching how to do this. First, there should be little chance that a rogue data-center admin can insert malicious software. When the system reaches the data center and gets powered on we should be confident that it's running our software completely unmodified. As I understand things, Secure Boot is designed to help with this and therefore should be enabled. However, by relying on Secure Boot alone, there will be no remote method of knowing that it hasn't been disabled until after the ZFS pass-phrase is provided to the initramfs via dropbear. At that point it's too late. An evil maid could have already subverted dropbear, for example, and just now stolen the pass-phrase. To avoid this I realized that a second requirement of using a TPM device to automatically unlock the ZFS root was in order. TPM devices have the ability of "sealing" data to so-called Platform Configuration Registers (PCR). This feature allows the data to be accessed only if the "measured" system state matches some original expected state. The TPM can fully start the system unattended but, if anything's unexpectedly meddled with, act like a tripwire requiring the pass-phrase to be typed in manually. If we ssh in and reach dropbear requesting the pass-phrase, we'll know that we either need to update our sealed data after a grub/kernel/initramfs update... or someone's been messing with our start up code. This window of opportunity will be too small for an evil maid to take practical advantage of. This sounded like the right track and I set out to try and configure both, Secure Boot and TPM unlocking of an encrypted ZFS root. I thought it'd take a few hours at most but it actually turned out to be a fair challenge. After a few failed attempts I started tenaciously documenting every avenue. Ultimately I developed helper scripts that can reproduce the configuration should the time come to actually ship a machine out the door. I'm reasonably satisfied with the outcome. However, the scripts haven't been reviewed and neither has the overall process itself. There were a lot of guides I followed that contained typos, bugs, dubious information or simply different requirements. I'm not sure everything is exactly "bullet-proof" for this show HN. For example, I'm beginning to wonder if Secure Boot is necessary and if the TPM alone is sufficient. So naturally, comments and criticisms regarding everything are greatly appreciated. The script files can be found here: https://gist.github.com/ReliefCrew/6beeef4ca3d9afc8fe233c7fcac93799 and here: https://gist.github.com/ReliefCrew/5f15a87bb33734daa68f38b485e95f3f Finally, I hope this effort will be useful to others facing similar needs.
Does the same job
all alternatives →- APA proactive way of securing your Linux server2020 · github.com · ▲143
- AFA file server for Android, end-to-end encryption, web access2020 · ▲20
Recently I've been playing with an idea of a file server on my Android phone, with a web browser access. I wanted to replace: - AirDroid - sending files to my own PC or laptop. - ShareIt - sending big files over the local network to my family devices. - Dropbox - sharing select files with other people over the Internet. Requirements I had in mind: - end-to-end encryption, no sign ups, no accounts, no passwords - local connection if devices are on the same network - asynchronous access, server should work seamlessly in the background This week I finally managed to stitch the pieces together…
- SASecurefs, a better transparent encryption filesystem2015 · github.com · ▲18
- ASAgam Space – Self-hosted, zero-knowledge, E2EE file storageJan 2026 · github.com · ▲6
I reposted, since i forgot the Show HN prefix. When I looked at self-hosted options, true E2EE turned out to be surprisingly rare. Most solutions rely on disk encryption, which only protects against physical theft, not server compromise or admin access. So I built Agam Space, my attempt at a self-hosted alternative to Mega or Proton Drive. It uses proper zero-knowledge encryption. Files are encrypted in the browser, and the server only stores encrypted blobs. Admins literally cannot access the files. It’s still in early beta, with very basic functionality and no professional security audit…
More life & fun this month
the category →- TL
Life & fun · 10d ago · louisabraham.github.io
Photosynthesis fires two of your iPhone
Life & fun · 28d ago · photosynthesis.camera
SoloUno▲310Take control of hair pulling, nail biting & skin picking
Life & fun · 28d ago · solouno.io
Scroll through all 43,252,003,274,489,856,000 reachable Rubik's Cube permutations.
Life & fun · 26d ago · everycube.alen.is
Hi HN, I built Eigendrum, a web tool that solves the 2D wave equation for arbitrary shapes so you can hear what they sound like as drums. How it works: * Solves -∇²u = λu using finite element analysis (Kφ = λMφ) on a triangle mesh. * Validated to <0.1% error against closed-form solutions for circles (Bessel zeros) and rectangles. * Sound model factors in strike location, Rayleigh damping, and mallet width. * Includes Kac drums I & II to demonstrate identical sound spectra from different geometries. * No frameworks, build steps, or dependencies. Repo and tests:…
Life & fun · 27d ago · baselashraf81.github.io
Launched alongside, March 2023
the whole month →
- BI
I'm a big fan of the BBC podcast In Our Time -- and (like most people) I've been playing with the OpenAI APIs. In Our Time has almost 1,000 episodes on everything from Cleopatra to the evolution of teeth to plasma physics, all still available, so it's my starting point to learn about most topics. But it's not well organised. So here are the episodes sorted by library code. It's fun to explore. Web scraping is usually pretty tedious, but I found that I could send the minimised HTML to GPT-3 and get (almost) perfect JSON back: the prompt includes the Typescript definition. At the same time I…
AI · 2023 · genmon.github.io