2

When setting up an apache2 server on ubuntu 10.04 Server should the home directories be encrypted? Or, should the complete disc be encrypted?

If the user home directories are encrypted will apache still have access? When the user is not logged in will apache2 have access to serve the files?

Improve this question
4
  • superuser.com/q/137790
    – M_1
    May 26, 2011 at 18:26
  • Ok, well that link didn't really answer my questions. I was hoping for a simpler answer.
    – Don
    May 26, 2011 at 18:45
  • When ubuntu server is installed it asks about encrypting the whole disc or encrypting the home partitions. I understand that encrypting the whole disc will make a reboot difficult on a headless server. What I don't understand clearly is if www-data can read the encrypted "home" directories.
    – Don
    May 26, 2011 at 18:47
  • It seems to me that www-data would not be able to read the 'encrypted' home directories unless they were owned by the www-data user, or, the user of the home directory is logged in. Would this be correct?
    – Don
    May 26, 2011 at 18:50

1 Answer 1

Reset to default
1

For apache, or any user/process to have access to a user's ecryptfs-encrypted home directory, the encrypted directory must be mounted. During login, mount.ecryptfs_private is used to mount the encrypted volume - the user's password being used to obtain the key to decrypt the volume. If the user isn't logged on, then you can script the mounting of the user home directories with ecryptfs-mount-private.

I've found references that say it's possible to automount volumes encrypted with ecryptfs utilities, but nothing that explains how to actually do it. If you really need encryption for all home directories, but want a system process to have access to them, you might want to consider implementing block-level encryption with dm-crypt or something else. Check out the /usr/share/doc/ecryptfs-utils/ecryptfs-faq.html file on your server and https://help.ubuntu.com/community/EncryptedHome for more information.

Lastly, deciding whether or not you need to encrypt data residing on disk is completely your choice - if you're concerned about the confidentiality of the data, then encryption is one of several tools you can use to protect it. The best security comes from evaluating your options and implementing a multi-tiered approach that fits your business needs - firewalls, patch management, ACLs, physical access, encryption...

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .