Your mission, should you choose to accept it, is to sneak into the earliest parts of the boot process, swap the startup config without breaking anything, and leave without a trace.

Are you ready? Let's begin.

the setup

For a long time I solved 1. by enabling “Power On" after "Restore AC Power Loss” in the BIOS and 2. with tailscale. However, I recently installed Arch with an encrypted boot partition, which means that boot doesn’t finish until I type in the encryption password.

Well. Well. What if I Simply put tailscale in initramfs?

the plan

initramfs

constraints

tailscale ACLs

Some background about Tailscale’s ACLs (“access control lists”). Tailscale’s users are tied to their specific login method: you can, for example, add a passkey, but that passkey counts as a fully separate user than your original account. Tailscale also has “groups” of users, which are what they sound like, “auto groups”, which again are what they sound like, “hosts”, which are a machine connected to the network, and “tags”.

Tags are odd, I haven't seen anything like them before. They group hosts, not users, and when you add a tag to a host, that counts as its login method, rather than the host being tied to a user account.

A consequence of this is that the group autogroup:member does not include tagged machines, because tagged machines aren’t tied to a user account. (A second consequence is that you can’t remove all tags from a machine without logging out and logging back in to associate it with your user account.)

So we can write a policy like this:

{
    "tagOwners": {
    "tag:initrd": ["autogroup:admin"],
  },

      "acls": [
    {"action": "accept", "src": ["autogroup:member"], "dst": ["*:*"]},
  ],

    "tests": [
    {
      "src":    "100.76.34.8",       "accept": ["100.102.101.127:22", "100.101.55.73:10078"],     },
    {
      "src":  "100.102.101.127",       "deny": ["100.101.55.73:10078"],     },
  ],
}

This says “allow devices tied to a user account to access any other device, and allow no permissions at all for devices tied to a tag”.

selene here is my desktop, and selene-initrd is its initramfs.

systemd before boot

Because initramfs is just a (mostly) normal Linux system, that means it has its own init PID 1. On Arch, that PID is in fact just systemd. That means that we can add systemd services to initramfs! There's a whole collection of them in mkinitcpio-systemd-extras (mkinitcpio is the tool Arch uses to regenerate initramfs).

We need two services: an SSH server (I went with dropbear) and something to turn on networking, which this collection names sd-network.

the heist

• Install the dropbear SSH server:

  pacman -S dropbear
  

• Install the systemd packages:

  yay -S mkinitcpio-systemd-extras mkinitcpio-tailscale
  

• Add networking (sd-network), tailscale (tailscale), and dropbear (sd-dropbear) to /etc/mkinitcpio.conf:

  1c1
  < HOOKS=(base systemd autodetect microcode kms modconf block keyboard sd-vconsole plymouth sd-encrypt filesystems)
  ---
  > HOOKS=(base systemd autodetect microcode kms modconf block keyboard sd-vconsole plymouth sd-network tailscale sd-dropbear sd-encrypt filesystems)
  

• Set up the keys for your new tailscale device:

  setup-initcpio-tailscale
  

• In the tailscale web console, mark your new device with tag:initrd, and disable key expiry. It should look something like this:

  

• In /etc/mkinitcpio.conf, configure dropbear to only allow running the unlock command and nothing else:

  SD_DROPBEAR_COMMAND="systemd-tty-ask-password-agent"
  

• Tell systemd to wait forever for a decryption password. I use systemd-boot, so I edited /boot/loader/entries/linux-cachyos. Under options, I extended the existing rootflags=subvol=/@ to rootflags=subvol=/@,x-systemd.device-timeout=0.

• Copy your public keys into /root/.ssh/authorized_keys so they get picked up by the dropbear hook:

  cp ~/.ssh/authorized_keys /root/.ssh/
  

• Generate a new public/private keypair for use by the dropbear server.

  dropbearkey -t ed25519 -f /etc/dropbear/dropbear_ed25519_host_key
  

• Setup early networking. (Note: these instructions are only for Ethernet connections. If you want WiFi in early boot, good luck and godspeed.)

  1. Add the following config in /etc/systemd/network-initramfs/10-wired.network:

  [Match]
  Type=ether
  
  [Network]
  DHCP=yes
  

  2. Register it in /etc/mkinitcpio.conf so it gets picked up by the sd-network hook:

  SD_NETWORK_CONFIG=/etc/systemd/network-initramfs
  

  All this rigamarole is necessary because the OS doesn't set the network interfaces to predictable names until late boot, so it needs some way to know which interface to use.

• Last but not least, rebuild your initramfs: mkinitcpio -P.

Next time you reboot, you should be able to ssh into $(hostname)-initrd and get a prompt that looks like this:

the getaway