Skip to main content
Unix & Linux

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

11
  • 1
    It sounds like you might need to rethink the choice of platform... I’m not sure Pis are really appropriate if you want to secure the payload. Commented Jul 20, 2021 at 18:24
  • @StephenKitt For better or worse, a Pi is what we have to work with. It has plenty of horsepower for what we need, and the price per unit is great. We just need to secure it somehow Commented Jul 20, 2021 at 20:36
  • it's possible to solve the kernel args part of the problem. Some bootloaders can be configured to require a password to override the configured args. e.g. if your RPis use grub as the boot-loader, you can do this (should be easily doable on an rpi 3 or 4, harder on older versions). However, as with the encryption key, that's just another password that can be read by anyone who has root or physical access to the machine (or just reconfigure it so that it doesn't require a password). Commented Jul 21, 2021 at 4:49
  • If you can't restrict physical access to the hardware and can't require the keys/passwords to be manually entered at boot time, then any security measure is going to be a time and convenience hassle to an attacker, rather than a complete blocker. The questions you need to ask yourself are: What kind of attackers are you envisioning/expecting? How determined do you expect them to be? How much effort and expense will it take to make it not worth their while (you really can't expect to stop a determined attacker with lots of time and money.....but you can expect to block casual curiosity) Commented Jul 21, 2021 at 4:55
  • @John I understand the attractiveness of the Pi here; but “We just need to secure it somehow” is a requirement which affects the choice of platform IMO. Other platforms have security equipment which the Pi lacks (or can’t use because of its boot sequence). Commented Jul 21, 2021 at 7:17