Re: NetBSD 10 RFE (ramdisk-cgdroot.fs in boot.cfg)

[adr <adr%sdf.org@localhost>]

arvind wrote:
> Hi friends, hoping someone might be able to help or point in the
> right direction. We have a NetBSD 10 machine that requires Root
> Filesystem Encryption (unlock using passphrase) during boot. The
> man pages are out of date and unfortunately not helpful
> (https://wiki.netbsd.org/security/cgdroot/).
>
> We are using UEFI/GPT. We have a boot partition but also another
> user defined partition (/backups) that is not encrypted.
>
> Once configured, would also like to add remote ssh unlock using
> something like Dropbear. This is the equivalent on the Linux
> platform(s):
> https://www.cyberciti.biz/security/how-to-unlock-luks-using-dropbear-ssh-keys-remotely-in-linux

Hi Arvind, not what you are asking, but some advise. Identify the
sensible data and encrypt _that_. Use CGD to encrypt real partitions
like home and backup if you like, but you could use vndconfig(8),
it would be easy to migrate in case of need. Writing some scripts
to access that data remotely will be easy. Don't waste time and
resources encrypting sensible data that will be recreated, use ram
disks for that.

adr