Login
You're viewing the mammut.moe public feed.
  • gemelengemelen
    Sep 9, 2026, 2:19 AM

    A strange but normal inquiry:
    FreeBSD 15.1-release, all on zfs, zfs native encrypted user home dir
    It's possible to configurate su, login, passwd to use pam_zfs_key - the dataset is mounted and decryped on local login.
    In case of ssh - the same is true for the password-based login.
    The question is - is there a working solution to mount and decrypt such dataset on a pubkey SSH login (say the sshd is configured to grab authorized_keys outside of the home dir)?
    To my knowledge, it's not complete and requires additional steps. Or a new pam module, I guess?

    💬 1🔄 1⭐ 0

Replies

  • Zimmiebob_zim@infosec.exchange
    Sep 9, 2026, 2:37 AM

    @gemelen More interesting would be certificate login, as you don’t need an authorized_keys file at all for that.

    💬 1🔄 0⭐ 0
  • gemelengemelen
    Sep 9, 2026, 3:09 AM

    @bob_zim
    It still converges to the same problem that zfs load-key has no input from a remote login.

    💬 1🔄 0⭐ 0
  • Zimmiebob_zim@infosec.exchange
    Sep 9, 2026, 4:08 AM

    @gemelen Yeah, but it gets a little more complicated because with SSH certs, the server doesn’t even have preexisting knowledge of the user’s public key. And if the user changes certs for whatever reason, their filesystem key would likely be unrecoverable.

    Might be doable via key escrow with a TPM or the like. Have the HSM respond to a valid signed challenge which with the symmetric key for the user who signed it.

    💬 0🔄 0⭐ 0