I feel super dumb right now.

I always thought, that all user data (/home/) are decently safe against physical access, as long as my user and root password is strong enough. If I just plug in the hard drive, nobody except the Super User has access to the data on it.

Well, the guys on the other community (Link) have shown me how wrong I’ve been.

All of my devices are securely encrypted. Well, all of them, except the most important one: my server, where all pictures, documents and other private stuff is stored.

Now, I’m afraid as hell that this will go wrong in the future. Imagine a vengeful ex girlfriend, a police raid, whatever.
It’s just dumb from my side to secure everything except the one thing that would need it the most.

I’ve already done my homework, and encryption doesn’t seem like a highly important topic in the selfhosting community, or on many servers else.
At least that’s what I’ve got the feeling.

The most common argument I hear is “nobody will get physical access anyway, so I don’t care”.


Threat model and security measures

My threat model: not high. I don’t do any illegal stuff and don’t have any enemies. Still, I want everything at least somewhat secure.
If it only serves the purpose to annoy the intruder it’s already enough.

The only thing that has online access is my Nextcloud (AIO from Docker), and that is already well secured against hacking attacks (password, 2FA, brute force protection, etc.).

It’s also the only thing that is worth securing in my eyes.


Options for encryption

LUKS2 full disk

I would need to factory reset the whole server for that, which would be … highly inconvenient for me. It took me quite a long time to get everything working, and I don’t wanna loose my configuration.

Also, how should I access the device when I don’t see anything? Is there a workaround or something when I want to reboot without a monitor and keyboard?

Only encrypt the home folder

Same problem as with FDE

Nextcloud server side encryption

That one isn’t recommended from what I’ve read. It causes compatibility issues and an extreme hit on performance according to forums. Is this still correct?

Cryptomator (?)

Encrypting and decrypting with every up- and download sounds quite annoying. Wouldn’t be my prefered method tbh.


What is your opinion on that topic? What would you recommend me?

Please remember, that I’m not that experienced as much, so please be patient with me 😬

  • TCB13@lemmy.world
    link
    fedilink
    English
    arrow-up
    2
    arrow-down
    2
    ·
    11 months ago

    You best bet is not to use Nextcloud in the first place because it will eventually fuckup your data. Same goes for Cryptomator (just google it), it tends do lose files with long names or in folders with a large number of files. There are instances where the vault never opens again also.

    A very important thing to consider is that whatever file backend you’re using it should support inotify and fuse-based stuff doesn’t support it. ecryptfs is a good option to encrypt the data, doesn’t fail and it isn’t fuse-based. It’s old however and may not be supported by every system/kernel.

    Why can’t you just created a data partition and encrypt with LUKS? Not full disk, just your data partition? VeraCrypt is another option.

    • PlexSheep@feddit.de
      link
      fedilink
      English
      arrow-up
      4
      ·
      11 months ago

      I don’t agree on hating on nextcloud, but moving that data to a luks partition could work.

    • Guenther_Amanita@feddit.deOP
      link
      fedilink
      English
      arrow-up
      2
      ·
      11 months ago

      I quite like your idea of just moving my data (not the other stuff) to another drive.

      How can I decrypt my drive without a GUI, monitor or keyboard?

      • TCB13@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        11 months ago

        SSH into the machine, type the password to unlock and start whatever services you need. If someone shuts it down they won’t be able to get to the data then.