There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

Simple safe encryption for a server?

Hi, I’m running a ubuntu based backup server. And was wondering if there’s a simple way to encrypt my drives in case they get swiped or something by a break in. But also in a way that the computer can be restarted and decrypt the drive without me needing to stick a key in everytime. Any ideas? It seems basic but I’m not an expert on all these newfangled encryption terminology, so would like something idiot proof (by idiot proof, not idiot enough to lose/forget the decryption key)

VitabytesDev ,

I think you can encrypt drives by using a key stored in the TPM, if you have one. See the Arch wiki for info.

Though I have heard the TPM is not as secure..

possiblylinux127 ,

That isn’t possible. I would look into physical security (ie a locked cage)

Flax_vert OP ,

If someone nicks it, can’t they just use boltcutters? Could hide the drive under the floorboards theoretically

possiblylinux127 ,

If someone shows up with bolt cutters then you have other issues. They just as well could hold you at gun point

Flax_vert OP ,

I mean the whole machine. Unless I cage it to the floor

iMeddles ,

I worte a guide last year on how I do network bound encryption - that is the disk will automatically decrypt at boot if it’s connected to my home network, but not if the disk or machine is removed from my house. The advantage over the dropbear method is that you can set unattended upgrades to auto reboot your server whenever it installs security updates, and it’ll come back up with no manual intervention from you.

sznowicki ,

Here’s my way of doing it. TLDR: LUKS with a encryption key hosted in my router

nowicki.io/self-hosting-lvm-raid1-with-key-over-f…

Anonymouse ,

Take some time and really analyze your threat model. There are different solutions for each of them. For example, protecting against a friend swiping the drives may be as simple as LUKS on the drive and a USB key with the unlock keys. Another poster suggested leaving the backup computer wide open but encrypting the files that you back up with symmetric or asymmetric, based on your needs. If you’re hiding it from the government, check your local laws. You may be guilty until proven innocent in which case you need “plausible deniability” of what’s on the drive. That’s a different solution. Are you dealing with a well funded nation-state adversary? Maybe keying in the password isn’t such a bad idea.

I’m using LUKS with mandos on a raspberry PI. I back up to a Pi at a friend’s house over TailScale where the disk is wide open, but Duplicity will encrypt the backup file. My threat model is a run of the mill thief swiping the computers and script kiddies hacking in.

unrushed233 ,

You can actually unlock LUKS from another machine over SSH: cyberciti.biz/…/how-to-unlock-luks-using-dropbear…

I’m pretty happy with this solution

ShortN0te ,

This is the way.

voklen ,

I saw this and thought “How is this even possible? No way you run an SSH server from initramfs…” Turns out that’s exactly how you do it, I’ll be trying this out thank you!

solrize ,

Do encrypted backups with Borgbackup or similar. That means the server never sees the plaintext or the decryption keys. The encryption happens on the client. Since it’s public-key encryption (separate keys for encryption and decryption), the client doesn’t need the decryption key either, except when restoring. So your backup can be automated without secret keys.

avidamoeba ,
@avidamoeba@lemmy.ca avatar

Only useful if the backup machine isn’t also used as a hot spare.

thayer ,

As mentioned elsewhere, the easiest method is to encrypt only the data drives. This way you can secure shell into the server upon restart and decrypt the data. I’ve been using this method for years now without issue.

ShortN0te ,

I am not seeing any benefit over this solution lemmings.world/comment/10027984 , were even the root is encrypted. With dropbear installed on initramfs you can also just ssh into the server to unlock everything.

thayer ,

The dropbear method is more secure overall, and I plan to incorporate it as well when I find the time to wipe/reinstall my server, but it’s arguably not as easy or simple, which is what OP requested.

themachine ,

If you want simple you’ll have to manually decrypt each time it needs doing.

If you want it to be “automatic” then your best bet is something network based. A “simple” would be to just have a script ssh’s somewhere, pulls the decryption key, and then decrypts the disks. There’s plenty of flaws with this though as while a threat actor couldn’t swipe a single encrypted disk they could just log in as root, get your script, and pull the decryption key themselves.

The optimal solution would be to also encrypt the root partition but now you need to do network based decryption at boot which adds further complexity. I’ve previously used Clevis and Tang to do this.

I personally don’tencrypt my server root and only encrypt my data disks. Then ssh in on a reboot or power event and manually decrypt. It is the simplest and most secure option.

wesker ,
@wesker@lemmy.sdf.org avatar

I use a luks encrypted USB drive for automated backups. My backup script mounts and decrypts the drive automatically, using secret-tool to grab the encryption pass from my keyring. It then creates the snapshots, and automatically unmounts the drive after.

There might be better methods, but this one works well for me.

avidamoeba ,
@avidamoeba@lemmy.ca avatar

If someone can login as root on that machine, by for example rebooting in recovery mode, they can also run the script and access the drives. Or they can get the password from the keyring. A keyring that doesn’t require a password to unlock or whose password is stored somewhere on the machine is equivalent to plain text storage. There’s no obvious solution other than ensuring the system can’t be rooted without a login, I’m just pointing the flaw out in case you feel it’s more secure than it is.

wesker ,
@wesker@lemmy.sdf.org avatar

In my case root partition is encrypted, and the keyring has to be unlocked every time you reboot.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • [email protected]
  • random
  • lifeLocal
  • goranko
  • All magazines
    •