Unlocking your LUKS via SSH and Tor

If you want to unlock your Computer remotely, and you are facing the problem, that you can’t reach your computer before your computer is unlockt. Tor will help you to reach your computer, even in during the boot process.

SSH in initrd

Prepare SSH host keys

It is very important that you create your SSH host keys upfront, otherwise you end up connecting to a server on the internet and typing in your Harddrive encryption password without verifiying the machine is actually yours!

Just run

nix-shell -p dropbear --run "dropbearkey -t ecdsa -f /home/tony/tor/host_ecdsa_key"

known hosts

It’s a good idea to add the host key (which got printed during creation) to your known_hosts file e.g. ~/.ssh/known_hosts or services.openssh.knownHosts.

Set up SSH in initrd

Setting up ssh is very easy.

# ssh setup
boot.initrd.network.enable = true;
boot.initrd.network.ssh = {
  enable = true;
  authorizedKeys = "ssh-rsa AAAAyourpublic-key-here....";
  port = 22;
};
boot.initrd.network.ssh.hostECDSAKey = /home/tony/tor/host_ecdsa_key; # maybe find a better place for that file

A small thing is still missing. Most likely your network card is not working without a module, so you have to find out which module is used for your network. I use lspci -v for that.

boot.initrd.availableKernelModules = [ "r8169" ];

Voila ssh should work now.

Tor in initrd

Prepare the Onion ID

You need 3 files to create an onion id (a.k.a. tor hidden service).

hostname
hs_ed25519_public_key
hs_ed25519_secret_key

To create theses files, you have to run tor once, with a dummy configuration.

DataDirectory /tmp/my-dummy.tor/
SOCKSPort 127.0.0.1:10050 IsolateDestAddr
SOCKSPort 127.0.0.1:10063
HiddenServiceDir /home/tony/tor/onion
HiddenServicePort 1234 127.0.0.1:1234

Let’s asume you created this file in /home/tony/tor/tor.rc.

Verify that everything is tor.rc awesome, by running tor -f /home/tony/tor/tor.rc --verify-config. If you don’t see any errors, just run tor -f /home/tony/tor/tor.rc.

You will get some output like this.

May 21 18:38:39.000 [notice] Bootstrapped 80% (ap_conn): Connecting to a relay to build circuits
May 21 18:38:39.000 [notice] Bootstrapped 85% (ap_conn_done): Connected to a relay to build circuits
May 21 18:38:39.000 [notice] Bootstrapped 89% (ap_handshake): Finishing handshake with a relay to build circuits
May 21 18:38:39.000 [notice] Bootstrapped 90% (ap_handshake_done): Handshake finished with a relay to build circuits
May 21 18:38:39.000 [notice] Bootstrapped 95% (circuit_create): Establishing a Tor circuit
May 21 18:38:40.000 [notice] Bootstrapped 100% (done): Done

Hit Ctrl-C and the files you need, should be in /home/tony/tor/onion.

Setup Tor

Now that you have your 3 files, you have to script a bit, but it’s not too complicated.

# copy your onion folder
boot.initrd.secrets = {
  "/etc/tor/onion/bootup" = /home/tony/tor/onion; # maybe find a better spot to store this.
};

# copy tor to you initrd
boot.initrd.extraUtilsCommands = ''
  copy_bin_and_libs ${pkgs.tor}/bin/tor
'';

# start tor during boot process
boot.initrd.network.postCommands = let
  torRc = (pkgs.writeText "tor.rc" ''
    DataDirectory /etc/tor
    SOCKSPort 127.0.0.1:9050 IsolateDestAddr
    SOCKSPort 127.0.0.1:9063
    HiddenServiceDir /etc/tor/onion/bootup
    HiddenServicePort 22 127.0.0.1:22
  '');
in ''
  echo "tor: preparing onion folder"
  # have to do this otherwise tor does not want to start
  chmod -R 700 /etc/tor

  echo "make sure localhost is up"
  ip a a 127.0.0.1/8 dev lo
  ip link set lo up

  echo "tor: starting tor"
  tor -f ${torRc} --verify-config
  tor -f ${torRc} &
'';

That was it. Tor should be running during your boot process.

Unlock your LUKS via SSH and Tor

When your computer boots, and asks for the LUKS password. Now you can unlock your encrypted Hard drive using:

torify ssh root@<onion.id>.onion -p 22 'echo "my-secret-password" > /crypt-ramfs/passphrase'