1

During the clean installation of CentOS 6.3, I choose to encrypt the primary partition / (the whole drive) (obviously except /boot).

My point is to have fully encrypted drive (8 drives in RAID10) but at the same time being able to reboot via SSH and not to be prompted to enter password as it's remove server (located in data-center).

My question is, how do i achieve it? How do I keep my drives encrypted and at the same time have the ability to reboot my server remotely without entering password on boot?

2
  • Can you get remote console access to the server via a method you trust? You could then remotely reboot the server, and then enter the passphrase to unlock the boot. Jan 12, 2013 at 21:31
  • You mean something like iLO, RMM3, DRAC? Well.. Don't know about that as I don't think it's pretty secure either! Don't know what would be other options though!
    – Ilia Ross
    Jan 12, 2013 at 21:53

1 Answer 1

1

How do I keep my drives encrypted and at the same time have the ability to reboot my server remotely without entering password on boot?

You don't. As you have realised, if you store the password/decryption key with the server, it's accessible should you be rooted or otherwise compromised. If you don't, reboots are non-trivial.

Why do you want to encrypt the entire of / anyway? What good does encrypting the OS itself do (I mean, even if you manage this, it'll lower your boot time since it has to decrypt before using them).

That is, why not just encrypt /home just most distributions offer? Then when you login /home is decrypted and mounted.

11
  • Actually, that what I would encrypt eventually /home and /tmp. I'm just testing it so far on the local machine. So, you're saying that if I only encrypt home, then it will not ask me for password on boot? Where the passwords will be stored to unencrypt /homethen and how?
    – Ilia Ross
    Jan 12, 2013 at 20:44
  • I've just tested. It still requires password for /home on boot. Is there a way to encrypt the password and store it some where and then insert it on BOOT?
    – Ilia Ross
    Jan 12, 2013 at 21:01
  • I think wiki.centos.org/HowTos/EncryptedFilesystem will answer most of your questions here. Is there a way to encrypt the password and store it some where and then insert it on BOOT? - this will entirely defeat the purpose of encrypting /home. The main reason for encrypting is if someone breaks into your server room and steals your server, they cannot get access at your data. Since the drive is mounted for read/write during normal server operations, hackers will always be able to access the unencrypted data (and, if you set it up like this, the keys need to decrypt it).
    – Jay
    Jan 12, 2013 at 21:09
  • 1
    I'm going to cut to the chase and just say no. If your NOC has physical access to the server, they will always be able to pwn you, no matter how hard you try to prevent it. If they want to mess with you, they can supply you with tampered hardware. So, you need to trust your NOC or just move elsewhere.
    – Jay
    Jan 13, 2013 at 0:11
  • 1
    This is my last contribution to this discussion. Powercut was an example, they could say your PSU has failed and need to chassis swap, say the network card failed and requires reinstallation. In most of these cases, NOC have a 4 hour SLA. More than enough time to clone your drives! The fact is, you are at their mercy. I think it's time you accepted that.
    – Jay
    Jan 13, 2013 at 20:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .