Mandos

The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote and/or unattended reboots.

Wouldn’t it be great if you could have the security of encrypted root file systems and still have servers that could boot up automatically if there was a short power outage while you were asleep? That you could reboot at will, without having someone run over to the server to type in the password?

Well, with Mandos, you (almost) can! The gain in convenience will only be offset by a small loss in security. The setup is as follows:

The server will still have its encrypted root file system. The password to this file system will be stored on another computer (henceforth known as the Mandos server) on the same local network. The password will *not* be stored in plaintext, but encrypted with OpenPGP. To decrypt this password, a key is needed. This key (the Mandos client key) will not be stored there, but back on the original server (henceforth known as the Mandos client) in the initial RAM disk image. Oh, and all network Mandos client/server communications will be encrypted, using TLS (SSL).

Last updated 7 Nov, 2008

User level: Intermediate

User Rating: