pi-encrypted-boot-ssh VS wireguard-initramfs

That's a very obvious and very obviously bad way of planting a network exploit. Very rookie and rather sad.

In entirely unrelated news, this guide details how to set up an encrypted boot process on a raspberry pi, with it waiting for you(r forked login agent) to ssh in and provide the LUKS password: https://github.com/ViRb3/pi-encrypted-boot-ssh

It's pretty easy to setup on a fresh install, and you can use dropbear to input the password remotely: https://github.com/ViRb3/pi-encrypted-boot-ssh

Encrypt RPI Boot: https://github.com/ViRb3/pi-encrypted-boot-ssh

Some other interesting things are providing keys over the network, or leveraging Wireguard and SSH to remotely unlock.

For vulnerabilities: even if dropbear was vulnerable in some way, it’s running in a pre-boot initramfs with a restricted shell which can be locked down even further to prevent escalation. To add another layer of security, you can run Wireguard in initramfs and have dropbear configured to be accessible from only the vpn network: https://github.com/r-pufky/wireguard-initramfs

Once you manage to reset the system, wireguard-initramfs should work if you need to SSH into it from outside the LAN, though the project is only currently supported on Debian. Within the LAN, dropbear in your initramfs should be enough.

There are other initramfs packages available that expand features such as wireguard capability: https://github.com/r-pufky/wireguard-initramfs

FYI, this is now the case. 2021-07-04

Just posted the first rev of wireguard-initramfs for debian bullseye.