Simple safe encryption for a server?

Submitted ⁨⁨3⁩ ⁨months⁩ ago⁩ by ⁨Flax_vert@feddit.uk⁩ to ⁨selfhosted@lemmy.world⁩

Hi, I’m running a ubuntu based backup server. And was wondering if there’s a simple way to encrypt my drives in case they get swiped or something by a break in. But also in a way that the computer can be restarted and decrypt the drive without me needing to stick a key in everytime. Any ideas? It seems basic but I’m not an expert on all these newfangled encryption terminology, so would like something idiot proof (by idiot proof, not idiot enough to lose/forget the decryption key)

source

Comments

Sort:hotnew top

unrushed233@lemmings.world ⁨3⁩ ⁨months⁩ ago
You can actually unlock LUKS from another machine over SSH: cyberciti.biz/…/how-to-unlock-luks-using-dropbear…

I’m pretty happy with this solution

source
- ShortN0te@lemmy.ml ⁨3⁩ ⁨months⁩ ago
  This is the way.
  
  source
- voklen@programming.dev ⁨3⁩ ⁨months⁩ ago
  I saw this and thought “How is this even possible? No way you run an SSH server from initramfs…” Turns out that’s exactly how you do it, I’ll be trying this out thank you!
  
  source
iMeddles@infosec.pub ⁨3⁩ ⁨months⁩ ago
I worte a guide last year on how I do network bound encryption - that is the disk will automatically decrypt at boot if it’s connected to my home network, but not if the disk or machine is removed from my house. The advantage over the dropbear method is that you can set unattended upgrades to auto reboot your server whenever it installs security updates, and it’ll come back up with no manual intervention from you.

source
solrize@lemmy.world ⁨3⁩ ⁨months⁩ ago
Do encrypted backups with Borgbackup or similar. That means the server never sees the plaintext or the decryption keys. The encryption happens on the client. Since it’s public-key encryption (separate keys for encryption and decryption), the client doesn’t need the decryption key either, except when restoring. So your backup can be automated without secret keys.

source
- avidamoeba@lemmy.ca ⁨3⁩ ⁨months⁩ ago
  Only useful if the backup machine isn’t also used as a hot spare.
  
  source
themachine@lemmy.world ⁨3⁩ ⁨months⁩ ago
If you want simple you’ll have to manually decrypt each time it needs doing.

If you want it to be “automatic” then your best bet is something network based. A “simple” would be to just have a script ssh’s somewhere, pulls the decryption key, and then decrypts the disks. There’s plenty of flaws with this though as while a threat actor couldn’t swipe a single encrypted disk they could just log in as root, get your script, and pull the decryption key themselves.

The optimal solution would be to also encrypt the root partition but now you need to do network based decryption at boot which adds further complexity. I’ve previously used Clevis and Tang to do this.

I personally don’tencrypt my server root and only encrypt my data disks. Then ssh in on a reboot or power event and manually decrypt. It is the simplest and most secure option.

source
thayer@lemmy.ca ⁨3⁩ ⁨months⁩ ago
As mentioned elsewhere, the easiest method is to encrypt only the data drives. This way you can secure shell into the server upon restart and decrypt the data. I’ve been using this method for years now without issue.

source
- ShortN0te@lemmy.ml ⁨3⁩ ⁨months⁩ ago
  I am not seeing any benefit over this solution lemmings.world/comment/10027984 , were even the root is encrypted. With dropbear installed on initramfs you can also just ssh into the server to unlock everything.
  
  source
  - thayer@lemmy.ca ⁨3⁩ ⁨months⁩ ago
    The dropbear method is more secure overall, and I plan to incorporate it as well when I find the time to wipe/reinstall my server, but it’s arguably not as easy or simple, which is what OP requested.
    
    source
wesker@lemmy.sdf.org ⁨3⁩ ⁨months⁩ ago
I use a luks encrypted USB drive for automated backups. My backup script mounts and decrypts the drive automatically, using secret-tool to grab the encryption pass from my keyring. It then creates the snapshots, and automatically unmounts the drive after.

There might be better methods, but this one works well for me.

source
- avidamoeba@lemmy.ca ⁨3⁩ ⁨months⁩ ago
  If someone can login as root on that machine, by for example rebooting in recovery mode, they can also run the script and access the drives. Or they can get the password from the keyring. A keyring that doesn’t require a password to unlock or whose password is stored somewhere on the machine is equivalent to plain text storage. There’s no obvious solution, I’m just pointing the flaw out in case you feel it’s more secure than it is.
  
  source
  - wesker@lemmy.sdf.org ⁨3⁩ ⁨months⁩ ago
    In my case root partition is encrypted, and the keyring has to be unlocked every time you reboot.
    
    source
VitabytesDev@feddit.nl ⁨3⁩ ⁨months⁩ ago
I think you can encrypt drives by using a key stored in the TPM, if you have one. See the Arch wiki for info.

Though I have heard the TPM is not as secure..

source
possiblylinux127@lemmy.zip ⁨3⁩ ⁨months⁩ ago
That isn’t possible. I would look into physical security (ie a locked cage)

source
- Flax_vert@feddit.uk ⁨3⁩ ⁨months⁩ ago
  If someone nicks it, can’t they just use boltcutters? Could hide the drive under the floorboards theoretically
  
  source
  - possiblylinux127@lemmy.zip ⁨3⁩ ⁨months⁩ ago
    If someone shows up with bolt cutters then you have other issues. They just as well could hold you at gun point
    
    source
    -> View More Comments
sznowicki@lemmy.world ⁨3⁩ ⁨months⁩ ago
Here’s my way of doing it. TLDR: LUKS with a encryption key hosted in my router

nowicki.io/self-hosting-lvm-raid1-with-key-over-f…

source
Anonymouse@lemmy.world ⁨3⁩ ⁨months⁩ ago
Take some time and really analyze your threat model. There are different solutions for each of them. For example, protecting against a friend swiping the drives may be as simple as LUKS on the drive and a USB key with the unlock keys. Another poster suggested leaving the backup computer wide open but encrypting the files that you back up with symmetric or asymmetric, based on your needs. If you’re hiding it from the government, check your local laws. You may be guilty until proven innocent in which case you need “plausible deniability” of what’s on the drive. That’s a different solution. Are you dealing with a well funded nation-state adversary? Maybe keying in the password isn’t such a bad idea.

I’m using LUKS with mandos on a raspberry PI. I back up to a Pi at a friend’s house over TailScale where the disk is wide open, but Duplicity will encrypt the backup file. My threat model is a run of the mill thief swiping the computers and script kiddies hacking in.

source