wireguard-initramfs VS dracut-sshd

Some other interesting things are providing keys over the network, or leveraging Wireguard and SSH to remotely unlock.

For vulnerabilities: even if dropbear was vulnerable in some way, it’s running in a pre-boot initramfs with a restricted shell which can be locked down even further to prevent escalation. To add another layer of security, you can run Wireguard in initramfs and have dropbear configured to be accessible from only the vpn network: https://github.com/r-pufky/wireguard-initramfs

Once you manage to reset the system, wireguard-initramfs should work if you need to SSH into it from outside the LAN, though the project is only currently supported on Debian. Within the LAN, dropbear in your initramfs should be enough.

There are other initramfs packages available that expand features such as wireguard capability: https://github.com/r-pufky/wireguard-initramfs

FYI, this is now the case. 2021-07-04

Just posted the first rev of wireguard-initramfs for debian bullseye.

There is also dracut-sshd, which works great for distros using - surprise - dracut.

Personally, I'm running OpenSuse Tumbleweed and used the graphical installer this time out of convenience. If you want to remotely unlock it over ssh, I can recommend https://github.com/gsauthof/dracut-sshd. Works pretty well.

The only thing that prevented me from going with MicroOS during my last server install was uncertainty about how well it would handle remote unlocking of luks system encryption for which I'm using dracut-sshd.

I'm trying to use the dracut-sshd package on Fedora 35. The instructions only describe how to use dracut-network and networkd to get a wired internet connection during boot (for SSH to work). I'm completely unfamiliar with these so I'm not sure what to change in order to make it work with a wireless connection instead. I tried changing their example in various ways with no luck.

I prefer this https://github.com/gsauthof/dracut-sshd