Is there a possibility to make Linux install automatically delete the data if wrong decryption key is set x amount of times?

Would be nice too, if it started automatically to overwrite the data too even full disk overwrite takes a lots of time.

I tried to google docs, but I don’t know the right words.

  • IsoKiero@sopuli.xyzsuomi
    1·
    1 year ago

    Doesn’t LUKS lock out any attempts for 60 seconds after 3 attempts anyway? That’s a huge blocker in the way for brute forcing. That’s 180 attempts in an hour, 4320 a day, etc. It’ll take a long time.

    The prompt running on (many) distributions boot has a time limit, but if you pull the drive and plug it into another host (or boot from USB) the limitation doesn’t exist.

    If you’re truly looking to wipe, I think you’d need to execute something at the OS level once unlocked/booted to detect incorrect attempts (if attempt >3; then dd if=/dev/zero of=/dev/YourDevice bs=2M or similar).

    You could bake that into init scripts since the kernel is already running. On the same spot where the time delay triggers you could just wipe the drive instead of prompting to wait until receiving new password. But that still leaves the option to pull the drive physically into another host and do whatever you like with it since the wiping code on the drive wouldn’t/couldn’t execute.