With all the new Raspberry Pi models and Kali changes from when we last covered this, we found the old process was in need of some updating. So we use the LUKS full disk encryption along with the LUKS Nuke capability to put this together. If you have a Raspberry Pi 3 Model B+, or really any other model or similar device, feel free to use the instructions below to set up your own secure system. This updated process is based on our previous documentation, and updated with some. This might seem like a lot, but its really pretty straightforward and once completed, we will be left with a RPi that will boot, get an IP from DHCP, and Dropbear will allow us to connect via SSH to provide the LUKS key. This permits us to run the RPi headless, but still keeping our data secure. Then down the road when we are done with it, we can retrieve it or remote in and destroy our data with LUKS NUKE. Preparing the Base system To start with, we need to write out the RPi image to a SD card. With that out of the way, we insert the SD card into the RPi and let it boot up. Next, we connect over SSH, update Kali, and install a few packages we will need. Take note, once we start this process, we are going to be changing a number of critical files on our RPi installation. This is what we will use for our examples going forward, so be sure to update the instructions with whatever value you received on your system. Now, before we start to create our initramsfs, we need to do a sly little hack to force cryptsetup to be included. To do this, we will create a fake LUKS filesystem. We dd an empty file, format it as LUKS, mount it, and put a filesystem on it. Setting up SSH and Initramfs Now we are on the home stretch. This part is really cool, as normally when a system running LUKS starts up, the boot process pauses to allow you to unlock the HDD with your LUKS key. To work around that, we are going to configure Dropbear to start up, allow you to authenticate with SSH, and then connect you to provide your LUKS password—all from remote! No line breaks in there at all. This change is due to the fact that we need to slow down Dropbear to ensure that networking is set up before Dropbear kicks in. At the end of the file, where it reads: On NFS mounts, wait until the network is configured. If you watch the boot, you should see Dropbear start up. At that point, you should be able to SSH into the system and unlock the drive. ECDSA key fingerprint is SHA256:L+QVP+OmncGDleuEoj77OlRGuCji2gp0c1gMYjUupU0. The versatility of these little devices combined with the power of Kali never ceases to amaze us.
