Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running Linux virtual machines on a cloud provider. So effectively, the disk is a VHD file. The machine will have some sensitive information on the disk, such as certificates, passwords... I would like to encrypt some part (or all) of the disk so that in case someone gets their hands on the VHD file, they can't recover the private information. Of course, since the server might be rebooted at any time by the cloud provider (security update, migration to a different physical host, etc...), asking for a password at bootup is not an option.

How can I achieve that, if that's even possible?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Nope. That's not possible. Physical security always trumps logical security. By hosting in The Cloud™ you've given up that physical security and are at the mercy of the hosting provider's security measures. The only possible measure you can do would be a boot-time password (essentially moving the security mechanism back to your physical control).

share|improve this answer
    
Thanks, that's what I thought. –  Flavien Jul 30 '12 at 15:44

One of the options is too place all the sensitive information on an encrypted partition (in the virtual disk). This partition shouldn't be mount at the boot time obviously. Also no services that need that info should be started also.

In the even of a reboot you will have to log in there and mount the encrypted partition. After that start the services you need.

May be it's not the best way, but should work for some cases.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.