linux4noobs@lemmy.world

  • Guenther_Amanita@feddit.deOP
    link
    fedilink
    arrow-up
    3
    ·
    11 months ago

    Thanks a lot for your answer. How would you encrypt a server? Typing a password every time it boots isn’t possible for me, since I would need a monitor for my headless server.

    • vsis@feddit.cl
      link
      fedilink
      arrow-up
      8
      ·
      11 months ago

      That’s why it’s not always an option.

      Some servers have some kind remote console hardware, with their own security issues.

      Your “threat model” is important too. Do you expect that server to get stolen? If it happens, is there critical data that should not leak?

      Maybe you need to encrypt a directory, and not the whole drive.

      • Guenther_Amanita@feddit.deOP
        link
        fedilink
        arrow-up
        2
        ·
        11 months ago

        My threat model isn’t high. Just normal stuff everyone has, but that would be disadvantagely if someone else got them.

        It’s more if a precautionary measure. It doesn’t have to be super safe, but better than nothing.

        • rgb3x3@beehaw.org
          link
          fedilink
          arrow-up
          5
          ·
          11 months ago

          Is this for your home? If it is, you don’t really have to worry about someone stealing your desktop. If someone breaks into your home, they’re looking for quick cash and jewelry and TVs. They’re not going to bother stealing your server to dig through files for something usable.

          • Guenther_Amanita@feddit.deOP
            link
            fedilink
            arrow-up
            5
            ·
            edit-2
            11 months ago

            I’ve had quite a bad experience with police for example.

            30 cops raided my home because of something trivial (I ordered a bit of non-psychoactive CBD-weed, which is, even in the most restrictive country you can imagine, ridiculous).

            Of course, I got the whole experience-pack, including strip searches and confiscating all electronics.

            Even though I believe them getting hold of any data wouldn’t have changed much, I’m still glad I had my devices encrypted.

            Just knowing they didn’t see my cringy pictures of my teeny-me, where I discovered Snapchat filters, is a big relief. 😅

            Yeah… that traumatized me a bit and maybe that’s the reason I’m worrying.

            Also, you could never know what will happen in the future. Maybe my GF will turn crazy tomorrow and use those embarrassing pictures against me. Who knows?

            I believe everyone should use encryption, even if they don’t have much to hide…

            • rgb3x3@beehaw.org
              link
              fedilink
              arrow-up
              3
              ·
              11 months ago

              Oh that’s a really good point. Don’t trust the cops, keep everything encrypted.

              Way safer in those situations.

    • AdamantiteAdventurer@beehaw.org
      link
      fedilink
      arrow-up
      1
      ·
      11 months ago

      I use Luks/Tang to unlock the server at boot from another computer that is always on too. If that one is down I’ll need to type it or power the other PC on, but otherwise it auto decrypts for me as long as I’m on the same network.

    • Papamousse@beehaw.org
      link
      fedilink
      arrow-up
      1
      ·
      edit-2
      11 months ago

      If Windows, use BitLocker.

      If Linux, use LUKS but you need to enter the passphrase at boot, you can securely put the key in TPM2 I think (à la Windows) but it may be complicated to setup, or just seal the phrase in TPM2 but if you boot on grub you can break grub and replace init with a shell in boot option and have access to the system I think :-/ but a simple crackhead thief would not understand that.

      You can also have the key on a USB key, but if on the server and the server get stolen, it’s useless. You can setup a “anywhereUSB” and have your USB key in another room/place, etc, there is others possibilities.

      I wanted to unlock with bluetooth but having the bluetooth HW driver and stack in initramfs was nightmarish a little bit :-/