ZKeys enables unattended reboots for encrypted disks
Original title: Unattended reboots with encrypted disks
ZKeys stores half of each encryption passphrase off-site and requires periodic keepalive messages to keep keys unlocked.
The author introduced ZKeys, a managed service for storing half of disk encryption passphrases remotely. Client machines fetch the key halves and send keepalive messages to stay unlocked. If the machine is stolen and offline for too long, the service locks the key. The client combines the halves locally to unlock the disk. It supports automatic reboots for FreeBSD and Fedora while protecting against theft.
- Splits passphrase so server holds only half
- Requires keepalive pings to keep key unlocked
- Locks key automatically if machine offline too long
- Must back up full keys in a third location
- Open-source client available for FreeBSD and Fedora
Impact: protects data by locking keys if machine is stolen
From the original article
6 min read at jmmv.dev
Do you run a small home server or NAS holding your precious photos and sensitive documents? If so, I suppose the drives are encrypted, right? But then…
By jmmv.dev by jmmv · jmmv.dev
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.