headless-fde | headless server installation with full disk encryption

headless-fde is a Shell library typically used in Ubuntu, Debian applications. headless-fde has no bugs, it has no vulnerabilities and it has low support. You can download it from GitHub.

A lot of techniques exist to install headless servers with full disk encryption: PXE + VNC, debootstrap, QEMU, local installation in a VM + dd, etc. I tend to find them hackish and ended up to use another option. I'm pretty sure that it's already explained elsewhere but didn't find it on the Internet, so here it is. Basically, the initrd.gz of a Debian-like netboot installation is customized to provide a remote shell through SSH at the beginning of the installation thanks to the preseeding method. It allows to install the distro as usual, but remotely. A custom script is run just before the installation finishes to setup the packages which will allow to unlock the disk remotely at each reboot. This was successfully tested with Ubuntu 16.10. The initramfs of the target system is configured to read the passphrase inside a TLS tunnel listening on TCP port 443 (thanks to socat). Previous versions of this project used to install Dropbear, but it was overkill and less secure.