Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server for which I want to protect the content. The server is located on a clients premises.

Is there a way to encrypt the content of a RAID DISK (at hardware level) ? What I need is that the server will not be able to start as long as the required password is not provided (the encryption key)

I will give the best answer to Miles, though the answer was not exactly to my question. But from all the comments, it seems that it cannot be done hardware or .. it cannot be done as I would like to.

share|improve this question
    
Isn't this kind of a silly question? The whole point of RAID is to make the whole setup appear as one block device, so when that happens you should be able to encrypt it just like any other hard disk. Software encryption would work fine as well, actually, the requirement for hardware encryption is a bit odd unless it's purely for performance. Also, if you find some hardware level encryption and its BIOS runs before your RAID, then it's the same idea for the other way around, you'd decrypt your X hard drives and then RAID them all on boot. –  gparent Nov 17 '12 at 19:40
    
Software encryption requires the start of the machine. This is something I would like to avoid as long as I do not know who starts the machine. That is why I asked the question, as this is something I couldn't find googling. –  Dumitrescu Bogdan Nov 17 '12 at 19:43
    
I don't understand what you mean. Hardware encryption also requires booting the machine if you ever want to see what's on the disk. –  gparent Nov 17 '12 at 19:46
    
to further clarify gparents point: You only have to choices. 1) manually enter a password, regardless of HW or SW. 2) Enter a password in a script on an unencrypted part (which would not be safe, just security by obscurity). –  Hennes Nov 17 '12 at 19:47
2  
You can't not have to enter a password and still have things secure by complete magic. Software or hardware will not change this. –  gparent Nov 17 '12 at 19:51
show 5 more comments

2 Answers 2

up vote 3 down vote accepted

Yes. You can encrypt a RAID volume, using TrueCrypt or any other whole-disk encryption software. The contents of the volume will be unreadable without the encryption key, regardless of who powers up the machine.

The traditional "benefit" of hardware encryption is added performance, not added security. Because many of today's high-end processors include support for hardware-assisted AES encryption, you are likely to experience similar (or perhaps even better) performance using software encryption.

share|improve this answer
    
Yes, true. But this is not the point of the question. If the "intruder" somehow guesses a password of the OS, then all the settings on the machine are vulnerable to export. This is not a question on security, is more a hardware related question, as I did not find data on raids capable to do this –  Dumitrescu Bogdan Nov 17 '12 at 19:51
3  
@DumitrescuBogdan How is guessing the keyphrase of the encryption in softwar any different to guessing the keyphrase of the encryption in hardware? Also, the OS password is a different thing altogether –  Dan Nov 17 '12 at 19:53
    
One course in my university (a long time ago), stated that if you have physical access to data, then you can find any password. I do not know if that is still correct, but if it is so, if then an unprotected disk can reveal all the data that it contains. So an OS password can be bypassed. What I wanted is that the RAID cannot be formed as long as the correct encryption password was not present. –  Dumitrescu Bogdan Nov 17 '12 at 19:58
1  
The information that you received in your course is obsolete. Today you need physical access to data and access to unlimited computing resources in order to crack something like a 30-character passphrase. The current conventional wisdom is that a strong TrueCrypt passphrase cannot be cracked by even a determined attacker, unless that attacker has access to supercomputers. –  Skyhawk Nov 17 '12 at 20:00
3  
Well if everything can be bypassed, don't run a server at all. That can't be hacked. Obviously if you're using a password system, then the correct password will work, no matter how you acquired it. –  gparent Nov 17 '12 at 20:00
show 1 more comment

Don't do this.

I'm in the process of trying to recover data from an encrypted RAID array that failed, and it's already cost my employer more than the data's worth. If you must encrypt, either encrypt individual disks, or create an encrypted partition for the important stuff.

share|improve this answer
1  
Encryption always complicates data recovery. However, if you are in the process of attempting to recover data from a failed RAID array, encrypted or not, your employer has bigger problems than the one immediately at hand. Why wasn't there a backup? Surely your employer knows that RAID is no substitute for backups. –  Skyhawk Nov 17 '12 at 22:11
    
@MilesErickson Encryption on a RAID volume complicates things much more than on a normal disk, believe me. Not only do you have to worry about getting the data off without being able to read it while you're recovering it, you now have to worry about your stripe size and block size the encryption algorithm works on, disk order and whatever vendor-specific fun the RAID card's done as well. Without being able to read the data raw to see if you're on the right track. As to my employer, well... job security or something, sigh . –  HopelessN00b Nov 19 '12 at 6:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.