Decrypting boot drives remotely using dropbear
Tags: linux, encryption
Published: 2019-05-16 12:50:50

---
title: Decrypting boot drives remotely using dropbear
published: true
tags: 
canonical_url: https://thej6s.com/articles/2019-03-05__decrypting-boot-drives-remotely/
---

Thesedays there is no reason not to encrypt your bootdisk: I would even say that you are acting negligently if you don’t.

There are moments where you cannot be physically present to decrypt a drive: For example in a server, a NAS or if you want to access your desktop PC remotely. Wouldn’t it be nice to be able to ssh into your machine in order to enter the encryption password? With `dropbear` that’s possible.

**NOTE:** Dropbear seems to have been very actively developed over the last couple of years - a lot of guides you will find on the internet are outdated. This article is up-to-date as of the beginning of 2019.

## What you need

This article assumes a up-to-date Debian or Ubuntu system - though similar ready to use initramfs packages are available for other systems. All steps have been tested on Debian 10 but should work on Ubuntu in exactly the same way.

## Installating `dropbear`

Dropbear consists of 2 components: - `dropbear` is a very lightweight SSH server - `dropbear-initramfs` is a initramfs integration for the `dropbear` SSH Server.

I have said initramfs a bunch without explaining what it does. For all intents and purposes initramfs can be thought of a micro-system that starts before you operating system that takes care of some plumbing (such as decrypting and mounting drives).

## Configuring `dropbear`

With `dropbear-initramfs` only minimal configuration is needed: The only thing you have to do in order to get everything to work is add the public key of your client device to `/etc/dropbear-initramfs/authorized_keys` and run `sudo update-initramfs -u` to update the initramfs image.

When rebooting the PCs IP-Address will be printend to the screen. You can now connect to the System using `ssh root@{YOUR_IP}` and use `cryptroot-unlock` in order to unlock your disks.

## Configuring a static IP-Address

Of course, looking at the screen to get the IP Address defeats the purpose - thus we have to make sure that the PC uses a static IP-Address while in initramfs. This configuration is different from the one already present in (`/etc/network/interfaces` or via NetworkManager) as it has to be present before the system is decrypted and booted.

To do that edit `/etc/initramfs-tools/initramfs.conf` and add a line under the `DEVICE=` line.

```
IP=192.168.0.30:192.168.0.1:255.255.255.0::enp5s0
```

This line is in the format `IP=ipaddress::gateway::netmask::hostname:eth` - the hostname can be omitted.

After running `sudo update-initramfs -u` again to update the initramfs image our PC will now boot using that static IP Address.

## Avoid host key colissions on the client

If you regularly ssh into the machine you might notices SSH warning you about changing host keys - this is because openssh and dropbear are 2 separate SSH Keys with separate sets of host keys. Using the same key for both is not recommended as initramfs is not encrypted.

To avoid host key colissions you can configure a separate trusted hosts store in the `~/.ssh/config` of your client:

```
Host jo-desktop-unlock
	Hostname 192.168.0.30
	User root
	UserKnownHostsFile ~/.ssh/known_hosts.initramfs
```

## Extra: Only allow decryption

Dropbear drops you into a shell by default - this has the main disadvantage that you have to remember the `cryptroot-unlock` command (there is no real help in the shell) which is error prone.

Luckily `dropbear` has a way of running a specific command immediately after connecting. To immediately run the unlock command add the following to `/etc/dropbear-initramfs/config`:

```
DROPBEAR_OPTIONS='-c cryptroot-unlock'
```