[dm-crypt] Shared library for cryptsetup

[Jürgen Pabel]

Dear Teddy (and everyone else),

I've read through the mandos documentation and looked at the relevant
sources. Here are my thoughts:

Adding a dedicated tokentube plugin is a no-go because there would be no
dedicated/unique input mechanism for tokentube (it would need to
communicate either via console, fifo, usplash or splashy and thus
collide with the other plugins). A possible solution would be to change
tokentube's implementation: instead of extending debian's askpass, I
could implement a new input interface for tokentube and have someone
implement a corresponding plugin for mandos. I don't really like this
approach - however, I think it's a viable solution if nothing better
comes along.

A seemingly practical approach would be to modify the "local" mandos
plugins (prompt, fifo, splashy & usplash) to detect whether tokentube is
installed (that's easy: check whether /etc/tokentube/ exists in the
initramfs) and if it is then prompt for both a username and password
(instead of just a password). Once both items are obtained each plugin
would need to call some tokentube functions to "convert" the credentials
into the tokentube authentication key that actually unlocks a LUKS
keyslot (via libtokentube.so). I don't like this approach because it
requires too much tokentube-related logic in mandos - but if you are OK
with it then I am too. 

Comments or other ideas?

Yours,
Jürgen

Am Freitag, den 25.09.2009, 20:51 +0200 schrieb Jürgen Pabel:
> Dear Teddy (and everyone else),
> 
> I was not aware of Mandos, but it's great that this project exists - I
> have been thinking about doing such a project myself. 
> 
> > My current idea for coexisting with TokenTube is for us to provide a
> > plugin which hooks into TokenTube.  This would require some adjusting
> > of the other plugins, however, and I'm not sure about what the ideal
> > solution would be.  I also see that "ssod" checks the name of the
> > connecting binary, so any Mandos plugin would have to fake being
> > "/lib/cryptsetup/askpass" in order to be accepted.
> 
> I'll need to read through your website to learn more about Mandos in
> order to make up my mind about how to best solve this.
> 
> > I'd like to hear you thoughts about this - together we might come up
> > with a plan to coexist peacefully?  :)  (I've sent this to the
> > mandos-dev mailing list, as I didn't find one for TokenTube.)
> 
> Of course - I think that by coming up with a reasonable solution that we
> will provide a real additional value to users. The TokenTube Development
> list is at tokentube-devel at lists.sourceforge.net - it's just me on there
> right now, though.
> 
> Yours,
> Jürgen
> 
-- 
Jürgen Pabel, CISSP

Akkaya Consulting GmbH
Eupener Straße 137
50933 Köln

Telefon: +49 221 9473007
Telefax: +49 221 4911970
Mobil:   +49 160 8806133

E-Mail:   jpabel at akkaya.de
Internet: http://www.akkaya.de