Remote key custody for unattended infrastructure
ZKeys is a service that stores encryption keys away from a machine and automatically makes them inaccessible if that machine goes offline for a period of time. This service is meant to enable automatic, passwordless booting of that machine while protecting its data from access if the machine is physically stolen, which is likely for laptops and even home NAS setups.
ZKeys is named after ZFS as this project originated with the desire to automate unattended boots of FreeBSD machines in a secure fashion. However, there is not much here that’s ZFS-specific and, in fact, zkeys supports Linux systems with dracut as well (such as Fedora) for unattended boot scenarios.
The client is written in Rust and lives on GitHub under
jmmv/zkeys. The server is built on my
own iii-iv framework but it is not
available.
Visit https://zkeys.jmmv.dev/ for more details on the product.
