Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Although there is plenty of information about how to create encrypted partitions (like, there's not much information suggesting what to encrypt.

Since amazon doesn't provide terminal access during boot, the system needs to be able to boot without the encrypted partitions, and load the dhcp and sshd daemons. After that the instance can be connected to manually or automatically and have the passphrase for the encrypted partitions be supplied.

Given all this, it's easy enough to encrypt /home, /tmp, and swap. Are there other parts of the filesystem that I can/should partition off and encrypt?

Edit: What can I partition off and encrypt, and still boot & load networking/sshd? For example, I experimented with encrypting all of /var but then networking wouldn't start since it needed files from there.

share|improve this question
Well, where are you putting the stuff you want encrypted? – ceejayoz Dec 19 '12 at 18:22
Right, I can take care of files I want specifically encrypted. This is about the linux filesystem itself. – Peter Dec 19 '12 at 19:07
That's going to depend on what your instance is doing, your data security requirements, etc. Some folks would need /var/log/apache2 encrypted, others wouldn't. You can answer this question better than we can. – ceejayoz Dec 19 '12 at 19:11


There is nothing to prevent you from creating encrypted filespaces via dd:
dd if=/dev/zero of=/home/dir/something count=$((65536*1024))

mkfs /home/dir/something
cryptsetup -d /dev/urandom create cryptoswap /dev/hda3
see also

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.