Encrypt content of disk without entering password at boot time

Question

I am running Linux virtual machines on a cloud provider. So effectively, the disk is a VHD file. The machine will have some sensitive information on the disk, such as certificates, passwords... I would like to encrypt some part (or all) of the disk so that in case someone gets their hands on the VHD file, they can't recover the private information. Of course, since the server might be rebooted at any time by the cloud provider (security update, migration to a different physical host, etc...), asking for a password at bootup is not an option.

How can I achieve that, if that's even possible?

Answer 1

Nope. That's not possible. Physical security always trumps logical security. By hosting in The Cloud™ you've given up that physical security and are at the mercy of the hosting provider's security measures. The only possible measure you can do would be a boot-time password (essentially moving the security mechanism back to your physical control).

Answer 2

One of the options is too place all the sensitive information on an encrypted partition (in the virtual disk). This partition shouldn't be mount at the boot time obviously. Also no services that need that info should be started also.

In the even of a reboot you will have to log in there and mount the encrypted partition. After that start the services you need.

May be it's not the best way, but should work for some cases.