Ceph CDS Infernalis, 4 Mar 2015

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: CDS Infernalis (Day 1) -- Simple ceph-mon dm-crypt key management

Description

Videos from Ceph Developer Summit: Infernalis (Day 2.1)

04 March 2015

https://wiki.ceph.com/Planning/CDS/Infernalis_(Mar_2015)

A

Real honest here.

B

All right so we're on to the next one here: the simple stuff, Mon DM, Crypt, key management, discussion for OST; and yes, this wasn't Sam yep those countries of us I know most things usually are I similan here. If paging dr. bras, yeah.

A

I can start with that I'll start by summarizing it and remind you should make sure your mic works, I, guess, okay, so that the basic status is that theft disk will configure diem crypt for you and when you put a disc it all sort of transparently starts up, but it's really kind of basic and that the team crypt key is just stored in SC and NC 5 keys.

A

So that's sells a piece of the problem in that you can take the individual OSD disk and throw it away and not worry about the data because it's obscured. But if you take the whole server, then you're still screwed, because they have the keys on the same server on a different disk. So the goal here is to make a non stupid key management scheme, that's better than that's youssef keys.

A

So there are like all kinds of crazy key management systems out there that you could potentially used to do this I think the high level goal, in my mind, is to do something that is uses a simple key manager. Ideally that's just part of SEF.

A

We already have all of most of the infrastructure sort of built into them on, but do it in a way that you could swap in a different key manager if you had some existing framework that you wanted to reuse for some reason, but for users who are justifying SEF Seth gives you sort of like a simple lightweight, integrated key management thing already, so the pieces are that the monitor can already sort of store. This arbitrary bits of key value data on the monitor these via the SEF configset API.

A

You can get and set keys, let's keys and you can restrict access those keys to other or to the I, see. If I can you can restrict access to those key value pairs using different off keys, so you could create an off-key that is only allowed to read sort of a prefix or a specific key from that config keystore, I'm using the word key and like 12 different boys, probably pretty confusing.

A

So if we did this, then we could take the actual DM Krupke Thor it on the monitor in this can feed, config key storage section and then have some other key. That's allowed to fetch it and use it to mount, configure DM crypt and go from there in reality, it's a slightly more complicated than that, because we wouldn't actually want to store the key.

A

We use Lux, just the Linux something key system which means that it's actually the key, is actually stored encrypted on the disc itself and the special locks metadata, and you have another key password. Let's call it password that lets you get that key that then decrypts, the damn crypt portion of the disk um Milan are you there are you there now I.

C

Knew hit me yes,.

A

C

Ok, so I'm here, okay,.

A

um So we've talked about this little bit offline and on email and now I'm, trying to remember where, where we ended up. So your your suggestion is to definitely use Lux to store the actual DM Kripke and if I remember correctly, you could also store other stuff in deluxe metadata portion like a uuid or something else is that true.

C

Well, we cannot start safe any other data, but who is part of those headers? So that's probably the only thank you. We need so rich. That's the identification of all the risk and we compare it with anything. So you already is there and we can even set on ye. That is this interface for death, so you can set something which is directly there's something similar event for GPT partition, Google, IDs, okay, okay,.

A

So I, my assumption was always that you want something: that's on the disk. That's the let's call the password the password that you then handle the monitor that the monitor says. Oh you're allowed to get the actual decryption key that you then use to unlock the actual game. Kripke that decrypts the disk, so there needs to be. There needs to be something that money OST is starting up. It presents to the monitor to tell the monitor that it's allowed to get get the real key and ideally that that something is something that you can revoke.

A

So the monitor says if that person comes along in the future, I'm no longer going to hand out that Keeks I know that that disk was compromised or thrown away, or something like that. So do you know what what is normally used in that context? I'm, not just by a word for it, but like in a in a normal management world.

A

What's the thing that you showed to the key manager that tells the key manager that they're allowed to give you all the all the keys.

C

Well, assign know, at least for example, for what I stream guys something called volume key which is central key scroll. So it's kisco pocket where you can embed the key and sent it through some other. If you raise some active directory or something like that, but I'm sure we won't use that. So if you want something very simple, let's probably overkill, but you want to store the key just implying on, monitor or use some yeah.

A

I mean it's just the thing that that that identifies that the disk is allowed to get the its decryption key, but that can be revoked so.

D

It is to revoke it and not just delete the key.

A

Yeah I think I think so because you might, you might think you lost the key lost the disk and then you get it back like. Maybe oh this PG can't pier and I threw out the encryption key I kind of want it back like I. Think it'd just be a little bit safer.

D

So you wouldn't actually do this, but hypothetically be something like on the on the monitor it's encrypted twice once with the disks local revocable key at once, with the master key, and you revoke it by deleting the one encrypted with the disk local keys. That was that the kind of situation you're talking about yeah.

A

I mean at the situation what I was imagining is slightly simpler, so you would say you had at the ability to store your sort of your token password thing on the disk and you would you would identify it with the UID, and so that's like your token, and there would be n of those potentially that are allowed to get the real decryption key forgot monitor, and so you would issue 1 to the disk when you create it. That says you, mr.

A

discs are allowed to get your key to decrypt yourself, and you can revoke that and then later on, you like recover, you cover the disk and you would issue a new one or maybe reuse the same. One I don't know, but if you revoke it, you could just delete that that issue token. But if you are a super user on the monitor, you could still wish you a new one and you'd still have you still. You never actually delete the encryption key like I think deleting the actual decryption key for the Disqus seems dangerous.

A

Generally, don't wanna do that.

C

Was the goal for the revoking / key? You just wants to do something quite beta disposal or yeah.

A

Well, yeah I mean so right. So if somebody is somebody at the disco's missing, you want to as soon as possible revoke access to its decryption key.

C

Gwen disk is missing or when disk is still there, I, even just to revoke it, so it can be used anymore without any special operation, because locks allows to just delete all the keys thought, so it's still like divine, but without without any key store there, and you can, of course, if you have some key scroll or some some backup of the of the key you can unrevoked it. So you can kind of insight again, but I'm, not sure which case we are talking about.

C

So whether this is remove and then you want to do something or you want to just, for example, remove the keys from the disk and then, for example, center disk for a pie, or something like that, so nobody can access it even if their address or.

D

Pt, if I'm understanding this correctly, the thing stages suggesting actually replaces what looks does so in so luxe luxe does the same thing, but it's by it generates a random encryption key or something which it uses to encrypt the disk and then at predefined header points in the desk. It stores a luxe header that contains encrypted copies of that encryption key that are encrypted with the UM allowed decryption passwords right yeah. But it's got a point about of the disk.

D

You put this in the monitor instead or you wouldn't actually need to encrypt them, because the monitor has its trusted right, so instead you'd simply use authentication to make a decision about whether the incoming token is allowed to read it or not. Yeah, it's not clear that luxe even adds anything there except another chain that might but not.

C

Only watch right.

D

Compromised why.

C

Do I want to do replace the functionality of locks, I, think you can just use that and just store store the unlocking passwords or have some key hierarchy for our walking so I.

D

C

D

Me about it, it's just that! What's isn't getting you anything because you're tellin.

A

D

It well, it buys you a much less horrible interface to DM crypt, which is true.

E

C

Derrick's, there is quite I hope, quite usable, I, even fight in library, for a managing clock, so the cherry I was designing good, so so I'm just asking why we don't want to lose that well.

D

So the challenge is that once you've lost that, so there are two cases right in the case where you still have the disk and you're about to throw it away. Then yeah you can use Lux to revoke its own key and now the discus is unreadable score. But if you don't physically have the disc because it got stolen, you can't use locks to revoke the key, because Lux's headers are stored on the disk. It still doesn't necessarily do anything for the person who has the disk because they would need to have the decryption password.

D

But if that's stored in etsy and they stole the machine, then you have a problem, though you need to store the decryption password somewhere other than the server and the point at which you're doing. That is almost the point at which locks isn't buying you anything anyway, because you would. You would never have two passwords in this situation to unlock the disk, because there'd be no point.

D

You did said have to authenticated tokens that you can add that you can use to ask the monitor for the password, though the mod it's more like having locks on the monitor, instead of spread around the disk in Hetar Sam. This isn't to say that using Lux is bad. It's just.

A

D

Layer of encryption or inattention.

A

We might as well, we might have to use my negative, but right.

C

And do know that the locks allows the data gender, so you can actually have the header on some different device and just manipulate with that. So what you got you can you can just have demitted metadata lose either can be just detached from another device in file. Actually so.

D

C

I'm not sure you'll be able to.

D

Could you factor it out so that you can have it make a call, a remote call to another server.

E

C

Then then you don't need looks like oh I can just use a blinding great because you are basically regular, like the endplate just.

D

A

You might still get your box well, I think that's kind of where we are but and I yeah. My sense is that we can or either we do or don't use lux. Whichever is convenient.

A

Insertive makes users more comfortable, but it doesn't actually add or remove any capability here right by the way, so I think that yeah I don't think it matters either way either it's either the thing that the monitors holding an escrow is the password to grip the lux key or it is the actual disk encryption key I think it doesn't matter either way, but actually you know it might be, might be slightly safer to use to store the actual encryption key, because it means that somebody couldn't accidentally screw up the lux header or something and destroy the key and advertently or render an inaccessible.

A

That's true, well think they're destroyable disk, without like sort of order in destroying my ohh I, don't.

D

Know you can still hit whatever there. Why else is to be equivalent of them? Yeah on the.

E

Other hand there.

D

Are two versions of lux: does its own hashing insulting to generate the to go from the password to the key, so it it might be the case that either that adds strength because it papers over problems with weak passwords which doesn't matter for us because we'd be randomly generating them or it removes strength by adding another weak point in the chain. So I don't know yeah.

A

I think it I think this I think this is sort of a red herring. So I think that the real issue is there needs to be the thing that you present to the monitor that says: you're allowed to get the key that can be revoked and that needs to go somewhere. So if, if Lux has a UID that you can set, then it just so happens that you IDs are 16 bytes right and the asf X keys are also 16 bytes.

A

Once there you encoded in all the metadata is padded on them, that's kind of a hack, but you could conceivably do that, but it would be.

E

A

E

A

There needs to be a thing on the disk that says: I'm I'm, the revocable thing that I felt.

B

A

That the monitor dentists- oh, here's, your here's, your decryption key intersting.

D

You could just present its own suffix authentication credentials right.

A

So the way that the monitor um yeah right so suffix lets you set and off capability that lets you access like a specific key, for example, the decryption key for DM crypt.

D

Every OSD separately already have it has a separate sucks, FX key.

A

Is stored encrypted in the OST directory on talked out a lot to my 15 Crypt is encrypted yeah. So this is the. This is the thing on the outside yeah right, so luxe might provide a convenient place. The clucks metadata area might be a convenient place to just stash that thing that we can set. I mean it's like.

A

That's it's 16 bytes is the actual key, but once you pat it out with all the other stuff, that's in the entity key structure, it's like your cryptic, restructure, its probably 30 bytes, or something and usually gets base64 encoded, so there's a little string, but we just need to put that somewhere. Basically,.

A

There's this does this make sense bo on.

C

Actually, I'm not sure I fully understand what you want to store any ID now, but whatever so.

A

I mean they're nice. There needs to be the there's. There needs to be the key, the password, that's something the token whatever you want to call it that you present to the monitor or some other keys management system that he'll.

C

A

C

A

C

Good about, but why it can't be just some random or some view ID with some prefix, which is just index or something which is sent to monitor and monitor, will just search if it's coming from the proper OSD and has the key paired with this UID and some data so that key to the kudos resume. Why.

D

Not simply use the hard disks own uuid.

C

D

Just just an index go txt on well that that one's comparatively public right, you don't really want other OS. These two other things too easily be able to see it. You'd wanted you'd. Rather it were secretly City secret yeah.

C

I think it's will be some encrypted to to monitor by some society or something like that, so why it's a break or yeah.

D

But any any process on a machine can read the / dev flash by uuid thing and you it is that's not secret.

C

Right, well, yes, that's all security, compare it with some identifica or some key for the for the questi. So still you can generate something, and you hey uh purposes from something here about it.

A

Well, it sounds like it sounds like you're, assuming that there's some there's some like a host level authentication, so you know that this particular server is allowed to be presenting it so like the way that the the way that nikki vanish and controls access to the key is using this secret right. It's not it's not host based. It's not anything else. There's like there's a secret that you presented, monitor that says: I'm allowed to get the decryption key.

C

But a connection to the monitor is already out of the gate. It's all just.

A

Winner, this is the key that you authenticate with the monitor with that's the thing: there's no host level will they see something right so when, when assuming everything's decryption you're starting up the OST authenticates with its key that its stores inside the file system, for example, if you're an admin you authenticate with the key, that's in at CCF keyring, but when you are an encrypted disk in order to get your decryption key, you need to authenticate with something right. It's not there's! No, there's! No like global host property.

A

That says that we could make one I guess that that's another option like you could say that this any disk that appears on this host is allowed to get access to the key. But then that doesn't work because then the the host would have to be able to access any OSD right and if a single compromised dos do you can get corruption keys for any other disk in the entire system. That's that's a big vulnerability like you want to do you want to narrow the scope as much as possible, so you sort of there.

D

Anyway, right, because if you, if you store that that key in blocks, then it has a it's either stored, point short: has a password right, yeah.

A

It'd have to be plain text because it needs to yeah. That's right, so.

D

A

D

Machine that can, but.

A

You don't actually.

D

Have to disk so I guess that's that.

A

Yeah right so did the two things that you need our access to the network, so you can talk to the monitor and the disk right and if you only have the disk but you're not on the network like you walked into data center and yanked it and walked out, then you have nothing if somebody actually gets into the data center and they have both the disk and they're like connected to the machine and they have root.

A

Then obviously, I'll bets are off because they can do everything that the disk can do to mount itself to decrypt it and then right. So that's.

D

All in that case, you might as well just just pass the disks uuid.

A

It just has to be something that isn't publicly shared beyond that host. Like has to be something that you can. You can look at end of whatever, but it yeah, but I think the the UID on the partition is the OS duid, that's also in the OSD map. What I think I'm not sure I'm, not sure about that, but I think that's the case. So it would be nice if there was just a separate space. That's I mean maybe okay, so that's possibility one.

A

Maybe that would just work, maybe the maybe the GPT label uid can be used as the key make sure it's not sure y on the host I'm afraid it might be, though, that's that's a problem because there's this FS ID well cuz. If I can carry out sorry I understand. No, I'm not I'm not sure. If that matches the partition label, you ID matches the actual internal OSD uid, okay and.

D

If it is, then you just generate a different appropriately sized number and stick it in the locks area. Okay, let the right yeah.

F

It didn't happen, is it's already a new ID, it's 40 hours, long long or something like that at least I had a base for that. So it is it acoustic.

A

Pacific uid, or is it just a 40 character, string.

F

That I thought the character uuid. I don't know like disp excess. It's a new ID.

D

F

Are you're, so you think I.

D

T, that is not a uuid. Okay yeah! That's a nice.

A

C

Can I can I have a question you re you are talking about or whatever your ID I either it's GPT partition, ID or rocks ID. It's not a secret for other processes. It's actually universes it and you can see it clearly in def uid. Does it this by UIC soo? So whatever I am so I think you cannot use that as some secret key. Oh yeah,.

D

I think we found the conclusion that it's not a secret key. It needs to be a key that you have as long as you're physically holding the disk, or you know about the machine with the discus program, but not one that you have, if you're simply observing a lot from somewhere else.

A

Well, it could be if it's stored on the device and not part of the GPT data, then only route can see it. Alright can only call me Brutus I'm.

E

A

Yeah, which is better so I yeah, it is but yeah.

C

Well, if you are route you can, if you have activated Jim quick device, you can directly get the encryption key anyways exactly it's exactly right now,.

A

So I think it's something that only route on the host with the disk can access is I, think the ideal situation, because that's when you're already screwed. So if that's the case, then, if there's somewhere in the lux header, where we can soar something that only route can get at that isn't parsed by you Devon putting sisal eorge, I.

C

Don't see because if there's hydra, which is which is available or order disk is readable, for other users are just going to hike it because I don't need to anchor it with another key or it's just public. So.

D

Right so did I. I guess the assumption is that anyone who has permissions to read the disk can see the key and that's just the way it goes. But anyone who doesn't wouldn't be a resi that would at least right up well something wrong. Yeah yeah.

F

The UID of the disk is not the same as see it was. The you ready is.

A

F

A question about okay, ready, just a question: um yeah.

E

I think he remembers doing if.

F

It's say me and then you can simply get a list of you IDs from the HTML on the right.

D

A

That's the case I'll karen.

F

Exactly then effort so, but.

A

Even if even if it's different, then any non root user on the system can also see all the you at ease because they're in dev disk. So ideally it would be something that's just stored in a random sector on the disk or something else that requires somebody to actually be able to read the raw block device. In order to read it mm so I mean.

E

A

Does the oh, hey Mon, so that the lux header lets you store like any arbitrary key as long as you have a password right? It's it's not specific. It's just a little lock box is that is that right. Well,.

C

And has two different parts: first part is visible header, which is passed by block ID and so on. There is the UI distort and some visible parameter for encryption, and then there are key slots that are actually eight key slots and there are encrypted, and it's actually contains the real encryption key. Oh so.

A

Maybe so maybe the thing that you hear is actually to use one of those slots to store the key to talk to the monitor and then use a sort of a well-known password to decrypt it. So maybe you're set back up, says deluxe lockbox packs, for it is. You know my cluster and.

E

A

E

C

Sourcing, good, that's something which is not possible with conversion, because there is, if you have enabled key slot, only the encryption key. It can be stored there for a conversion, because I, the part of the part of the unlocking is that there is some kind of chicks on. So you enter password, it will iterate, it will decrypt that and it will check if the password it decrypt it key is correct. If not correct, it will just fail. So you cannot store everything they are just randomly so I'd be at work.

C

I would like to have new version of flags where this is possible, but for conversion it is so simple. So so.

D

It's not a lockbox. It's only useful for storing their.

A

Key okay, so there has to be a DM crypt partition that uses that key on the same device. That you're saying.

B

A

Confused because you can, you said you can also put the lux thing- the deluxe metadata on a different device right. Yes,.

E

D

A

Key, it's just a different kind of key.

D

Well, it sounds like.

A

C

Search doesn't.

A

D

C

We can yes, we can. We can use that on Heather and defend attached header and store something there that that's possible, but yeah that could be could be done. You can, you can have just just a file or some different partition just with dogs under weather and store something kinky slow, but it seems to me like over can be complicated here.

C

E

The suggestion.

D

If it has to be a different header, then we don't get anything right well,.

A

Okay, now it lets see, it said that the process would be that the in the set comp would have. You know: Lex secret equals foo to you'd use use food to unlock on key call. It are three left key get done at that with just key bar for.

A

Us then, you would use use, use dart teams, damn crypt vlx using bez.

A

So that has the a benefit that you not only need. You need the disc and access to the network, so you can talk to them on and you need to know what was in softcom, which was on a different disk in the same system, which also seems kind of nice.

A

My neck sounds so.

C

Duh, no sigue, don't EE start inside corner nothin.

A

Yeah this is this is the key. That's just enough to get the the SF monitor key out of the lux yeah.

E

And she's medicate.

A

With a monitor to get the real decryption key or not the ticker songs, you believe yeah.

C

It's something called authentication token to monitor or how to say that. Yes, yeah well, that's very simple solution, but why not.

A

So bad, which I'm a real encrypt hides that from you, Oh Crips, that it does or whatever that.

A

Make sense to you, Danny.

F

Hey what you should sing I'm thinking about this? How was the actually key in the moniteur stalks, okay, so animals.

A

It is encrypted.

F

Or what it's on the fire at the end so I'm, my own devices didn't they'd.

A

Have like let's eat at three dash Lux equals bath. This would beat. This would be the actual key value that's in there and then you would also have Oh street three dash luck. Stash. You know: okay equals.

A

The key value and then you would have an off user. You know client, but bucks.

A

You got three which has key equal to and mon equals wow config key.

F

Yeah, that's that's somehow clear to me. The question is how the data or sort the real data is.

A

So this is this: is that only one.

D

Day one I mean yeah, so reason not is distorting point text, I mean.

A

It's already already in it's the thing that it's the plain text thing that you give to lux on the disk to decrypt the real key yeah I. Guess that's! That's my but yeah so Mohan brought this up to like. Is there a reason not to just sore that plain text, I guess, yeah I guess.

F

That's the point you.

D

Need to have it both it and the you. You need to have both it and the disc to do anything, and also the monitor, isn't going to use different encryption keys for each one of these or, if it does it'll be generated so like or they'd have to be stored in the same database. I, don't know that there's any real value in it's not like we. It's not like.

D

We put the encryption key somewhere else and have a separate authentication, think we're at them past self, the same information to some other authentication manager, which then passes back the decryption key for this key and.

A

Even even if you fetched like all of them today and then three weeks on the line, you got the disk like. Yes, you can, you can put the two together, but you know you guys. The only thing that prevents that is that you would rotate them, and this actually has everything that we need to rotate it, because bags can be changed too fast too, and the lux thing comes.

C

A

Fourth of youth best you right yeah just by dated book, but then.

F

You can do it, rotating doesn't hurt because you can brute force it or do you mean with rotating generate new, and we.

A

Will generate a completely random, you know 32 32 bytes of right. You could do I think in reality. Nobody probably would do that, but you could. If you were worried that somebody dumped a copy of all of the stuff on the monitor and at some future date they might steal a disk. Then you could go through and rotate all these and you would be protected again.

A

F

I mean yeah, the dollar problem would be to steal to this enter data from Ramona to same date and then yeah.

A

F

A

Have simply that's.

F

Us is there any way to crypt it in some way to not have a plaintext ants well,.

D

That's that's the point, how could you create or how could you encrypt it.

E

D

That the map, where the monitor didn't, also have access to the decryption key or.

A

The disk didn't have access the decryption key right, yeah like if you encrypted it with something than the disk has to be able to decrypt it, in which case your it has yeah. You already need the key in it. Yeah still the same number of things, you'd compromiser. It.

F

Would be cool to have something that you can plug in in this place, cliff to use a different key? Wouldn't it.

D

Would be the same thing, whatever perfect yeah.

F

Yeah, for example, if you was Bobby cannon or something I, didn't know blue state context, and you have at least a separated system. That is not part of surf itself, so it's maybe more secures them it's it.

D

Really would be easy enough title.

F

D

Be easy enough to make this pluggable right, just whatever you store in Lux is uninterpreted and that something from the south cobb tells you what to wear where to get your yorkie and what plugin to use to do it or.

A

Inset that disk it's going to make these, you know the stuff call defconfig key get and that could instead do you, know Mikey manager and get key, not that thought right.

F

A

A

Low on do you still have concerns, is this? Is our great progress isn't solving I.

C

Don't like storing any key implying, but here it's probably the simplest, cheapest way and I expected in some in some corporate configuration there. Maybe it will be replaced by some real key storage like something so so we should probably have it as some real photo need interface book instead of storing Kiki in implying you just call some key management system or something like.

D

That, okay, I guess I guess, there's one virtue to storing it, not in plain text. You could present the decryption key to the monitor on startup and it could not record it.

C

And what I would that.

D

Would only blame addressed I suppose you.

C

Can have some encrypted key storage and just populate on the start. You have to decrypt it somehow so still have some key, but Papa write it to some keyring like karna, recurring or so, where it basically is designed for. Storing the TV when, when are in the system, but but for simplicity, I think that the first implementation probably should be essentially hear what the probably storing in plain text in files is that you never know where it's coco peat when first, if file system is doing something you can manipulate, is with that.

C

So you can have many copies in some sectors. So that is that the problem is showing the time.

A

But I mean it so it still feels like it's a it depends on what you're defining as the key, because this isn't the key. This is the key to decrypt the key right. The access is talking box. It's.

E

So you getting ripe for this, then.

A

Somewhere, there's the key to decrypt the other key. Well, the so.

D

The it seems to me the only advantage encrypting the key is this is the specific case: we've lost them on disc, but they don't have access to them on to some other piece of bond configuration. So you could provide the monitor with the decryption key for all of these things, that start up, which it just uses and doesn't write down and that that way, at least, if you lose the disk right but I, think that's the only thing it buys you and.

A

I think that if you get, if you get them on and you get that if you get the key escrow system and you get the thing- that's its managing- then you're screwed, no matter what right.

D

And you can always run them on on it on an encrypted block partition anyway, which, if you want to throw it away, you're, probably going to do yeah or if you that is, if you want to be able to throw at the disk. That's probably what you're going to do. Yeah.

F

I mean the question is how how realistic scenario that somebody is stealing a disk from a tree data center I mean I mean at how often villas Adam I mean that was interesting. Eddie's at this. From from our side, the most interesting thought would be the issue to dispose disks I mean yeah well,.

A

That that's already felt today right. Thank you. You can just rip individual discs out and they're in the root partition, yeah yeah.

F

Yeah, but why do you suppose a computer? Well then, yes examine the issue ya.

A

Mean that the scenario that I am to hear is that you have the disgruntled employee, who you know just pull the machine out of the rack in the data center and walks out the door or something like that. Yeah.

F

D

You scrub, we employ a couple.

A

Please to do a lot of stuff, yeah, probably grad lee keeps all this way up to, or maybe that I guess I guess it's more likely to be the data center employee who get goes into your cage and pulls out your uh your server. They.

F

Don't have done this, but they got me a problem where yeah, but then he is a problem to reconstruct the surf stuff. I mean: what does he have done? Yes right as objects? Oh yeah, yes, make something out of it here out of one so a tool yeah.

D

F

Take their I mean what you can watch.

A

Have a saving credit cards at.

E

D

You can just grab out various patterns and you could get a yeah.

A

I think that's that's. That's the typical scenario right where people and tripped.

F

Also, your so that your auto Spock devices tilt- and you don't have that problem but yeah- that's correct.

A

All right, okay, we've or over. We probably beaten this. This horse.

D

The next one's going to be very short, so there actually is more stuff to talk about. That's fine, yeah, okay,.

A

A

B

What I actually.

A

You know what there is one big thing here and that is that the the session between a client on the CLI and the monitor is secure and when they negotiate and they enable they negotiated session key. That doesn't reveal any secrets between the two.

A

But thereafter, once you're authenticated the actual commands that go back and forth our scent plain text over the wire, so I think in order to sort of complete this sixer, we need to have some simple encryption that uses we're yo session key that just uses those AES or whatever, on the actual bytes that go over the wire. Maybe when there's a special option so that you're only doing this when you're doing talking to the monitor from the CLI or whatever.

A

Maybe there's like a that, you know SEF dash, dash encrypt session dot, dot or something that enables this so that when your, for example, installing off authentication keys, you're not actually sending the keys that you're installing plain text over the network, just sort of.

E

A

Just a current current thing that a few people have noticed that I'm richer politics.

A

That means in simple messenger option to encrypt a Kip the actual messages over the wire based on me, assisting I.

A

Think it's pretty simple. We already have all the it just means like calling a s encrypt on the buffer list before we send it over the wire like it. Even it could even be just the everything after the header. So like a better plain text, maybe it just as everything I don't know: I, don't whatever we have to figure out a layered in, but.

A

B

A

That one's think so by the way down in your videos frozen if you click and unclick your video button, little knowledge.

B

A

Me that was hot. That's my phone.