N E T W O R K - B O U N D D I S K E N C R Y P T I O...

51
NETWORK-BOUND NETWORK-BOUND DISK ENCRYPTION DISK ENCRYPTION NYRHUG Monthly Meeting - February 2020 http://people.redhat.com/pladd Patrick Ladd Technical Account Manager FSI [email protected]

Transcript of N E T W O R K - B O U N D D I S K E N C R Y P T I O...

Page 1: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

NETWORK-BOUNDNETWORK-BOUNDDISK ENCRYPTIONDISK ENCRYPTIONNYRHUG Monthly Meeting - February 2020

http://people.redhat.com/pladd

Patrick Ladd Technical Account Manager ­ FSI [email protected]

Page 2: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Booting... 

 

Disk Password: █

Page 3: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Booting... 

 

Disk Password: █

Booting... 

 

Disk Password: █

Page 4: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Booting... 

 

Disk Password: █

Booting... 

 

Disk Password: █

Booting... 

 

Disk Password: █Booting... 

 

Disk Password: █

Page 5: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Booting... 

 

Disk Password: █

Booting... 

 

Disk Password: █

Booting... 

 

Disk Password: █Booting... 

 

Disk Password: █

Booting... 

 

Disk Password: █

Booting... 

 

Disk Password: █Booting... 

 

Disk Password: █

Page 6: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Standards (AES, PCI-DSS, etc.)

YESTERDAYYESTERDAY

Automation

TODAYTODAY

Policy

TOMORROWTOMORROW

Page 7: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

HOW DO WE AUTOMATE?HOW DO WE AUTOMATE?

Page 8: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Shh... I'm Secret!

Page 9: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Encryption Key

Shh... I'm Secret!

Page 10: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Key Encryption KeyEncryption Key

Shh... I'm Secret!

Page 11: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Key Encryption KeyEncryption Key

Shh... I'm Secret!

"correct battery horse staple"

Page 12: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Key Encryption KeyEncryption Key

Shh... I'm Secret!

"correct battery horse staple"

STANDARD PASSWORD MODELSTANDARD PASSWORD MODEL

Page 13: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Key Encryption KeyEncryption Key

Shh... I'm Secret!

"d41d8cd9...ecf8427e"

Escrow

STANDARD ESCROW MODEL?STANDARD ESCROW MODEL?

Page 14: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Key Encryption KeyEncryption Key

Shh... I'm Secret!

"d41d8cd9...ecf8427e"

Escrow

TLS / GSSAPI

STANDARD ESCROW MODEL?STANDARD ESCROW MODEL?

Page 15: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Key Encryption KeyEncryption Key

Shh... I'm Secret!

"d41d8cd9...ecf8427e"

Escrow

TLS / GSSAPI

STANDARD ESCROW MODEL?STANDARD ESCROW MODEL?

Page 16: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Key Encryption KeyEncryption Key

Shh... I'm Secret!

"d41d8cd9...ecf8427e"

Escrow

TLS / GSSAPI

STANDARD ESCROW MODEL?STANDARD ESCROW MODEL?

Page 17: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Key Encryption KeyEncryption Key

Shh... I'm Secret!

"d41d8cd9...ecf8427e"

Escrow

TLS / GSSAPI

STANDARD ESCROW MODEL?STANDARD ESCROW MODEL?

KDC/CA

Page 18: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Key Encryption KeyEncryption Key

Shh... I'm Secret!

"d41d8cd9...ecf8427e"

Escrow

TLS / GSSAPI

STANDARD ESCROW MODELSTANDARD ESCROW MODEL

KDC/CA

Backups

Page 19: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Key Encryption KeyEncryption Key

Shh... I'm Secret!

"d41d8cd9...ecf8427e"

Escrow

TLS / GSSAPI

STANDARD ESCROW MODELSTANDARD ESCROW MODEL

KDC/CA

Backups

HEARTBLEED

Page 20: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

LESSONS LEARNEDLESSONS LEARNEDPresuming TLS will protect key transfer is dangerousComplexity increases attack surfaceEscrows are difficult to deployX.509 is hard to get right

Page 21: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

ASYMMETRIC CRYPTO?ASYMMETRIC CRYPTO?

Page 22: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1
Page 23: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

(EC) DIFFIE-HELLMAN KEY EXCHANGE(EC) DIFFIE-HELLMAN KEY EXCHANGE

S ∈ R [1, p − 1]

s = gS

⟵ s

C ∈ R [1, p − 1]

c = gC

c ⟶

K = gCS = cSK = gSC = sC

Page 24: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

BINDING WITH ECDH (INSECURE)BINDING WITH ECDH (INSECURE)

S ∈ R [1, p − 1]

s = gS

⟵ s

C ∈ R [1, p − 1]

c = gC

K = gSC = sC

PROVISIONINGPROVISIONING RECOVERYRECOVERY

Discard : K,C

c ⟶

K = xS

⟵ K

Retain : s, cWeaknesses:

 

Resolved: c MUST be private

1 K is revealed to a passive attacker.

2 With c, the passive attacker can get K.

3 Server learns c and therefore K.

Page 25: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

MCCALLUM-RELYEA KEY EXCHANGEMCCALLUM-RELYEA KEY EXCHANGE

S ∈ R [1, p − 1]

s = gS

⟵ s

C ∈ R [1, p − 1]

c = gC

K = gSC = sC

PROVISIONINGPROVISIONING RECOVERYRECOVERY

E ∈ R [1, p − 1]

Discard : K,C

x = c + e

x ⟶

y = xS

⟵ y

K = y − sE

Because : K = gCS + gES − gSERetain : s, c

e = gE

To keep c private, e & E MUST be private.

Page 26: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Key Encryption KeyEncryption Key

Shh... I'm Secret!

Server

MR Exchange

Page 27: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Key Encryption KeyEncryption Key

Shh... I'm Secret!

Server

MR Exchange

Crypto HW

Page 28: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

Property Escrow MR Exchange

Server presence during provisioning Required Optional

Server presence during recovery Required Required

Server knowledge of keys Required None

Key transfer Required None

Client authentication Required Optional

Transport encryption Required Optional

End-to-end Encryption Difficult Unneeded

Page 29: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

TANGTANGhttps://github.com/latchset/tangServer-side daemonSimple: HTTP + JOSEFast (>2k req/sec)Extremely smallMinimal dependenciesRHEL 7.4

Page 30: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

$ sudo yum install tang 

$ sudo systemctl enable ­­now tangd.socket

INSTALLING A TANG SERVERINSTALLING A TANG SERVER

Page 31: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

CLEVISCLEVIShttps://github.com/latchset/clevis/Decryption automation and policy frameworkMinimal dependenciesEarly boot integrationGNOME integrationRHEL 7.4

Page 32: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

$ yum install clevis 

 

$ echo redhat | clevis encrypt tang '{"url":"http://localhost"}' > mydata.jwe 

The advertisement is signed with the following keys: 

  haD7Y­8VkAyJo6­vdZMrGQXCSfI 

 

Do you wish to trust the advertisement? [yN] y 

 

$ cat mydata.jwe 

{"ciphertext":"­O59czAqybvxHdme2t3I5A", ...} 

 

$ clevis decrypt < mydata.jwe 

redhat 

 

$ systemctl stop tangd.socket 

 

$ clevis decrypt < mydata.jwe 

$ echo $? 

1

BASIC ENCRYPTION WITH TANG / LUKSV1BASIC ENCRYPTION WITH TANG / LUKSV1

Page 33: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

$ clevis bind luks ­d /dev/sda1 tang '{"url":"http://tang.srv"}' 

The advertisement is signed with the following keys: 

  haD7Y­8VkAyJo6­vdZMrGQXCSfI 

 

Do you wish to trust the advertisement? [yN] y 

Enter passphrase for /dev/sda1: 

 

$ luksmeta show ­d /dev/sda1 

0   active empty 

1   active cb6e8904­81ff­40da­a84a­07ab9ab5715e 

2 inactive empty 

3 inactive empty 

... 

 

# For root volume unlocking at boot: 

$ yum install clevis­dracut 

$ dracut ­f 

$ reboot 

 

# For removable storage GNOME unlocking: 

$ yum install clevis­udisks2

DISK BINDING WITH TANGDISK BINDING WITH TANG

Page 34: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

[root@nbde7 ~]$ ip route 

default via 192.168.122.1 dev eth0 

default via 192.168.122.1 dev eth0 proto dhcp metric 100 

192.168.122.0/24 dev eth0 proto kernel scope link src 192.168.122.170 

192.168.122.0/24 dev eth0 proto kernel scope link src 192.168.122.170 metric 100

KNOWN ISSUESKNOWN ISSUES

dracut / NetworkManager integration problems

Active BZ with fix pendingShouldn't hurt in most cases, but it looks bad

Page 35: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

FROM AUTOMATION TO POLICYFROM AUTOMATION TO POLICY

Standards (AES, PCI-DSS, etc.)

YESTERDAYYESTERDAY

Automation

TODAYTODAY

Policy

TOMORROWTOMORROW

Page 36: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

SHAMIR SECRET SHARINGSHAMIR SECRET SHARING

threshold = ?

Page 37: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

SHAMIR SECRET SHARINGSHAMIR SECRET SHARING

threshold = ? threshold = ?

Page 38: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

SIMPLE LAPTOPSIMPLE LAPTOP

unlock?

Admin Password

User Password

threshold = 1

Page 39: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

AUTOMATED LAPTOPAUTOMATED LAPTOP

unlock?

Admin Password

User Password

threshold = 1

Tang

Page 40: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

HIGH SECURITY SYSTEMHIGH SECURITY SYSTEM

unlock?

User Password

User Password

threshold = 2

User Password

Page 41: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

COMPLEX LAPTOP POLICYCOMPLEX LAPTOP POLICY

unlock? QR Codethresh. = 1

SSS TPMthresh. = 2

SSSthresh. = 2

Password

Yubikey

Tang

Bluetooth

Page 42: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

$ echo PT | clevis encrypt sss \ 

'{"pins": {"tang": [{"url": "http://a.tang.srv"}, {"url": "http://b.tang.srv"}]}, "t": 1}' \ 

> out.jwe 

The advertisement is signed with the following keys: 

  haD7Y­8VkAyJo6­vdZMrGQXCSfI 

 

Do you wish to trust the advertisement? [yN] y 

 

The advertisement is signed with the following keys: 

  Edp­ESShUx4_95kGt­DTsCBbPag 

 

Do you wish to trust the advertisement? [yN] y 

 

$ clevis decrypt < out.jwe 

PT 

 

# Bring Down Tang Server A 

$ clevis decrypt < out.jwe 

PT 

 

# Bring Down Tang Server B 

$ clevis decrypt < out.jwe 

$ echo $? 

1 

BASIC SHAMIR'S WITH TANGBASIC SHAMIR'S WITH TANG

Page 43: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

EXPLORING THE ECOSYSTEMEXPLORING THE ECOSYSTEM

Page 44: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

DEPENDENCY: JOSÉDEPENDENCY: JOSÉhttps://github.com/latchset/joseJSON Object Signing and EncryptionC Library & Command Line UtilityBottom Line: User-Friendly, Standards Compliant Crypto

$ jose jwk gen ­i '{"alg": "A128GCM"}' ­o oct.jwk $ jose jwk gen ­i '{"alg": "RSA1_5"}' ­o rsa.jwk $ jose jwk gen ­i '{"alg": "ES256"}' ­o ec.jwk  

$ echo hi | jose jwe enc ­i­ ­k rsa.pub.jwk ­o msg.jwe 

$ jose jwe dec ­i msg.jwe ­k rsa.jwk 

hi 

$ jose jwe dec ­i msg.jwe ­k oct.jwk 

Decryption failed! 

 

$ echo hi | jose jws sig ­i­ ­k ec.jwk ­o msg.jws 

$ jose jws ver ­i msg.jws ­k ec.pub.jwk 

hi 

$ jose jws ver ­i msg.jws ­k oct.jwk 

No signatures validated!

Page 45: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

DEPENDENCY: LUKSMETADEPENDENCY: LUKSMETAhttps://github.com/latchset/luksmetaStore metadata in LUKSv1 header gapC library & Command Line Utility

$ echo hi | luksmeta save ­d /dev/sdc1 ­s 2 ­u EC998562­B60D­47F0­A579­DCA8C12F5BF6 

 

$ luksmeta load ­d /dev/sdc1 ­s 2 ­u EC998562­B60D­47F0­A579­DCA8C12F5BF6 

hi 

 

$ luksmeta load ­d /dev/sdc1 ­s 2 ­u 12618962­A1E5­48F1­B327­D7C60E20FC02 

Slot contains different UUID

Page 46: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

JOSÉJOSÉPKCS#11 SupportPython BindingsAdditional crypto backendsAdditional algorithms

CLEVISCLEVISPassword PinPKCS#11 Pin (including, in the future, TPM)Ext4 encryption support

TANGTANGBinding IDs (Optional; sacrifices anonymity)Revocation (requires Binding IDs)

FUTUREFUTUREFEATURESFEATURES

Page 47: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1
Page 48: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1
Page 49: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

DEMODEMO

Page 50: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

RESOURCESRESOURCES

RHEL 7:

RHEL 8:

Multi-device setup

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Network-Bound_Disk_Encryption.html

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening

https://access.redhat.com/articles/4500491

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Network-Bound_Disk_Encryption.html
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening
https://access.redhat.com/articles/4500491
Page 51: N E T W O R K - B O U N D D I S K E N C R Y P T I O Npeople.redhat.com/pladd/NYRHUG_NBDE_2020-02.pdfD I S K B I N D I N G W I T H TA N G [root@nbde7 ~]$ ip route default via 192.168.122.1

QUESTIONS?QUESTIONS?


Prelude and Fugue in E Minor [BWV 847] - Free-scores.com · i i j i j a ] k k [m m k k k k o n i k k m k o ` ` k k k y i k k \ y ` i k n i i j i j a k b k b k k k k k o o o o y o

Prelude and Fugue in E Minor [BWV 847] - Free-scores.com · i i j i j a ] k k [m m k k k k o n i k k m k o ` ` k k k y i k k \ y ` i k n i i j i j a k b k b k k k k k o o o o y o

B I S N I S K O S – K O S A N DI KOTA SAMPIT

B I S N I S K O S – K O S A N DI KOTA SAMPIT

140-Z E N G İ N L İ K - F A K İ R L İ K

140-Z E N G İ N L İ K - F A K İ R L İ K

2010 Census - Census Tract Reference Map · 2011. 3. 10. · L i c k i n g R R i v L i c k i n g Ri v F l e m i n g C r k L i c k i n g R iv L i c k i n g R i v L o c u s t C r k

2010 Census - Census Tract Reference Map · 2011. 3. 10. · L i c k i n g R R i v L i c k i n g Ri v F l e m i n g C r k L i c k i n g R iv L i c k i n g R i v L o c u s t C r k

K i n n i c k n i c BID NO. 44: KINNICKINNIC AVENUE R i UV ...city.milwaukee.gov/ImageLibrary/Groups/cityDCD/planning/cpc/Items... · uv 794 k i n n i c k i n n i c r i v e r uv 794

K i n n i c k n i c BID NO. 44: KINNICKINNIC AVENUE R i UV ...city.milwaukee.gov/ImageLibrary/Groups/cityDCD/planning/cpc/Items... · uv 794 k i n n i c k i n n i c r i v e r uv 794

WHO WE ARETupp OppI l (A hIn a ang | AInIg i n * pI i n u n I I hIn n @lI ? f h i k n an n ( agn ( Uup (i InIg i n mIn i I k ang^ L lp i Ian Ian In an n i Ig In k p I k f l hang a

WHO WE ARETupp OppI l (A hIn a ang | AInIg i n * pI i n u n I I hIn n @lI ? f h i k n an n ( agn ( Uup (i InIg i n mIn i I k ang^ L lp i Ian Ian In an n i Ig In k p I k f l hang a

H I N K I N G

H I N K I N G

K A D I N L I K D R A M I

K A D I N L I K D R A M I

K A J I A N F I S K A L R E G I O N A L P R O V I N S I K ...

K A J I A N F I S K A L R E G I O N A L P R O V I N S I K ...

B e n e d i c t I n k · B e n e d i c t I n k B e n e d i c t I n k B e n e d i c t I n k B e n e d i c t I n k. Created Date: 3/25/2017 11:09:21 AM

B e n e d i c t I n k · B e n e d i c t I n k B e n e d i c t I n k B e n e d i c t I n k B e n e d i c t I n k. Created Date: 3/25/2017 11:09:21 AM

arxiv.orgP k;i(P j2N i(k);j6=i a i;j(k) P~ 1 k;j e k;j + a i;i(k)P~ 1 k;i e~ k;i), where P~ k;j = P k;j+ n i(2 i+1) 2 I n ;if i6= j, and j2N i. According to the consistent estimate

arxiv.orgP k;i(P j2N i(k);j6=i a i;j(k) P~ 1 k;j e k;j + a i;i(k)P~ 1 k;i e~ k;i), where P~ k;j = P k;j+ n i(2 i+1) 2 I n ;if i6= j, and j2N i. According to the consistent estimate

K I N G S T O N

K I N G S T O N

K E L A B K E B A J I K A N K A K I TA N G A N P U S AT A ...

K E L A B K E B A J I K A N K A K I TA N G A N P U S AT A ...

H K G H < U N B A B Q ? K D B O I J H P ? K K H < < I E ...tony/oppetoo/plasmafyysika/plasma_physics.pdf · I n § © ¨ · ¸ + (),)≅ I n - - E >= + +.. Z = § © ¨

H K G H < U N B A B Q ? K D B O I J H P ? K K H < < I E ...tony/oppetoo/plasmafyysika/plasma_physics.pdf · I n § © ¨ · ¸ + (),)≅ I n - - E >= + +.. Z = § © ¨

n i k k e i i m a g e s - Nikkei Place

n i k k e i i m a g e s - Nikkei Place

Pain Final With K I W I N

Pain Final With K I W I N

w w w . j o h n z i n k . c o m i n f o @ j o h n z i n k . c o m · 2017. 6. 13. · 8 w w w . j o h n z i n k . c o m i n f o @ j o h n z i n k . c o m John Zink World headquarters

w w w . j o h n z i n k . c o m i n f o @ j o h n z i n k . c o m · 2017. 6. 13. · 8 w w w . j o h n z i n k . c o m i n f o @ j o h n z i n k . c o m John Zink World headquarters

E T I K A K O M U N I C I R A N J A

E T I K A K O M U N I C I R A N J A

AFGHANISTAN: Operational Humanitarian Capacity (3W) · pa k i s ta n i r a n t u r k m a n i s ta n u z b e k i s ta n ta j i k i s ta n c h i n a j a m m u & k a s h m i r! !!!!!

AFGHANISTAN: Operational Humanitarian Capacity (3W) · pa k i s ta n i r a n t u r k m a n i s ta n u z b e k i s ta n ta j i k i s ta n c h i n a j a m m u & k a s h m i r! !!!!!

V I K I N G Srecreation

V I K I N G Srecreation