OK, so…
The normal way to actually encrypt the harddrive is already standard,
and you use it by using LUKS - it’s called “LUKS”, for some reason.
And the problem is that when you boot it, it looks like this.
Actually in text mode, nowadays it’s all graphical and stuff, but in text mode it looks like this.
And,
let’s see now, OK.
O…K.
Now,
normally, on the computer’s hard drive, it looks like this: You have a boot partition, which is unencrypted,
and the rest is encrypted.
That is, if you installed with encryption as I showed you before,
in only one step, also in Ubuntu actually.
In Ubuntu you have to
pick
either the “Alternate” install CD or the “Text mode” install, but not the graphical install, but then you can choose it in one step.
Anyway,
now you get…
In that case you get this type of thing.
Um…
In the Mandos system
we add a small OpenPGP key
on the unencrypted partition.
Then we have the Mandos server,
on the same local network.
And,
at boot,
It sends,
or it connects
from the…
a small client program,
and connects via TLS, encrypted,
using the OpenPGP key, to the Mandos server over the local network.
The server looks up the fingerprint of the OpenPGP key,
in a list it has.
“OK”, it says, “Ooh, it’s this fingerprint, I should send this binary mysterious blob to the client.”,
and it does so.
So,
the OpenPGP key, then,
is used to decrypt this blob
into a password,
and the password is then used to decrypt
the encrypted hard drive, which is the real hard drive which is used to boot the rest of the system.
So, yeah, that’s the basic design.
Hmm, I want to take some of this.
Oh yeah,
we use ZeroConf, and Apple users may know this as “Bonjour”,
to actually find the servers on the local network,
automatically. Because, when you’re booting,
this is, like, before we have an IP address configured on the
local client computer, so we can’t use normal IP
communications there.
And we use… all use…
As I said, we don’t have IP addresses even, so we have to use IPv6, because they’re…
they always have something called “link-local” addresses,
and they are always there and always useful,
even though nothing is configured.
So, yeah, this is a more
technical overview. Let’s see
if there’s anything useful here or it’s only to confuse people.
Okay, fine, skip this slide, it’s just confusing.
Ah, the ac…
This is a more technical description of how the
client side of it works.
And the server,
apparently.
Maybe I can point with this thing.
This is the Mandos client computer which is connected to a local network server here — this is the Mandos server process
for that computer, I think.
The client program runs a plugin runner which
starts a number of plugins.
This plugin asks
for passwords at the
text prompt, as usual, as you saw before.
So you can still type in your password, that’s not a problem.
And then if you have a graphical password prompt, you have a plugin for this, and
there are many graphical password prompts, nowadays.
Like this.
There’s a backward compatibility thing,
and you can also write your own plugins really easy.
And there you have our main
magic plugin here which actually
is the Mandos client thing which actually communicates over the network with the server.
But since you have all these plugin things, you can
easily customize this to your heart’s content.
And this is basically it, this is the address for the home page of the project. It’s available, now, in
Debian unstable
and Ubuntu.
There’s a small bug, but we hope they’ll fix it, because it’s not our bug,
it’s a library we use, but
they changed it and now it doesn’t work anymore.
But it still works
if you compile it
and install it from our repository into Debian stable it will work perfectly.
Anyway, this is the graphical password prompt
that you normally get.
Hand me the network connection.
You could type in the password now,
if you’d like, wanted to.
Then…
Since we have a network now, suddenly it detects it, and has already transfered the password from the computer over there.
And now it’s continuing to booting up.
You can use this on servers,
and as long as one other computer is on the local network,
you can reboot the server remotely without any problems,
and still have encrypted disks.
There’s a question?
Yeah, I was thinking of the automated trick. Is it possible to
run Mandos servers on multiple machines?
Yeah, sure. That’s the… Yeah, we thought of that.
If…
Actually, that’s one of the
principle behind the idea:
So long as one machine is up,
it can boot up the other machines.
Now, you don’t need to actually have one Mandos server on every machine, but you could have.
And…
Say you have it in a mobile phone — you don’t have it nowadays, but you could have —
so, it could actually authenticate your computer when you have it in your pocket, but
so long as you’re not near it, it won’t work.
So, basically…
And if someone went in and actually… You know, the common idea is,
when someone steals your stuff at home,
they don’t go slowly
trying to mess around with one computer,
they are going to take everything
and carry it away.
Or if someone takes, you know,
walks into your nice data center and looks very kindly on one of your computers,
they’re all… Again, they’re going to take
everything away
and sort out the rest later.
And,
if that happens,
everything will just shut down.
That’s the whole idea.
If everything’s dead, it stays dead.
If…
But so long as everything looks normal,
then everything is probably normal, and your computer will boot up normally.
More details:
Multiple Mandos servers on the same local network will not conflict.
A Mandos client will try all of them in turn,
and try automatically new ones as they appear,
until it gets a password it can pass on.
So, it will work perfectly with multiple Mandos servers booting up each other,
and we thought of that –
that’s how we use it ourselves.
Anything else?
Sorry?
Oh yeah.
The server
actually checks that the clients are still alive
using a method,
because if a client’s…
You can bypass this
pretty easily if you know what you are doing,
but it’s still…
But it’s not really that big a danger, because people are still going to turn everything off and carry it away.
Question?
I’ve quite a problem, I don’t know how problematic, but…
If I were to steal
five of your computers, and keep one on,
in my car, with a battery,
would I still be able to boot the four other computers then?
The question is “If you stole all of them, and you kept one on a battery,
would you still be able to boot up the rest of them?” The answer is “No”, because the other machines have been down too long,
because we…
that… The thing that
I was going to tell you about. No, it’s my mike!
The server…
By default, the server pings all the other machines, and if they’ve been down too long — you can configure that —
the server stops sending out the key for those machines.
It’s actually called “Heartbeat system”.
Yes.
And it’s actually
configurable, so you can actually make how
complicated a system you want.
…sends a heartbeat.
Yes.
So you can actually make it
so advanced that it actually checks, you know, authenticates that it’s really the computer. You can have
some really advanced hardware to check they are
connected to, you know,
something specially…
You can make it how much you want — it’s
all configurable.
By default we do “fping”,
a simple ping just to, you know,
to have something very simple to implement.
And you have a cable to time
Yes, it’s a timeout.
…disconnect the connection.
Yes, there’s a timeout for each client.
So, yeah, that’s basically it; that’s the Mandos system,
that’s why you can now,
using this system,
use encryption on your servers. And you should use encryption on all the machines you could use encryption.
And, encryption is not only for hiding something,
it’s for keeping control of what you have.
Yeah, that’s all I want to say.
I think we’re done.