>This is not secure. An attacker can always open the case replace the hard
>disk with an imposter containing a rougue kernel that boots, probes the cmos
>for its value and writes it to the screen. The attacker can then use this
>info to modify the filesystem as desired.
No, an attacker couldn't.. If you reread my post I suggested a 'cmos like
device' that 'forgets' the password if the system is tampered with...
So unless he knew where the microswitch was and used a torch to cut around
that part of the case he would not be able to snatch it... And he would
probable not know this system was in place unless he was in insider as
its operation would be invisible until it was tripped...
As for you second point.. Your correct.. I thought you were planning on
encrypting it and signing it.. I didn't realise you ment only for tamper
detection.... My card idea still stands though... It could even be setup
so that it needed two passwords to that a single sysadm couldn't go it
and hex edit security policies.. :) But before we go about securing the
hardware I'd think that there would need to be a big overhaul of system
security... The vms like discussions going on a bit back seemed smart...
The hardware would really be most useful as a tripwire on the software
tripwire config and program... (what you are suggesting is already done
in userland (on a smaller scale) by a program called 'tripwire')..
As for MD5 being as fast as a harddrive.. What about someone with a 5
disk scsi array? I doubt MD5 could do 20meg/s even on a PPRO.... Sure
it's faster then my IDE raid0 1.2wd & 800wd.. but why would I be
concerned with that kinda security..... I think it would be better to
have a e2fs attr for 'checksummed' and a tripwire program that monitored
marked files.. The checksummer could be in the kernel and the test could
also be in the kernel.. And if you are really paranoid then you could
have that little tamper detector hardware I suggested (which I doubt
would cost much to produce) which could make sure no one rebooted the
system and played with the filesystem.. But this all would be a very hard
undertaking unless there was support for a userland security daemon..
(like kerneld)... Which could handle very fine grained security...
As for the exportability of hashes... Considering it reletivly easy to
build a good block cipher from a hash, it prob wont be long until some
countries outlaw them too... :)