Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

During the clean installation of CentOS 6.3, I choose to encrypt the primary partition / (the whole drive) (obviously except /boot).

My point is to have fully encrypted drive (8 drives in RAID10) but at the same time being able to reboot via SSH and not to be prompted to enter password as it's remove server (located in data-center).

My question is, how do i achieve it? How do I keep my drives encrypted and at the same time have the ability to reboot my server remotely without entering password on boot?

share|improve this question
    
Can you get remote console access to the server via a method you trust? You could then remotely reboot the server, and then enter the passphrase to unlock the boot. –  becomingwisest Jan 12 '13 at 21:31
    
You mean something like iLO, RMM3, DRAC? Well.. Don't know about that as I don't think it's pretty secure either! Don't know what would be other options though! –  Ilia Rostovtsev Jan 12 '13 at 21:53

1 Answer 1

up vote 1 down vote accepted

How do I keep my drives encrypted and at the same time have the ability to reboot my server remotely without entering password on boot?

You don't. As you have realised, if you store the password/decryption key with the server, it's accessible should you be rooted or otherwise compromised. If you don't, reboots are non-trivial.

Why do you want to encrypt the entire of / anyway? What good does encrypting the OS itself do (I mean, even if you manage this, it'll lower your boot time since it has to decrypt before using them).

That is, why not just encrypt /home just most distributions offer? Then when you login /home is decrypted and mounted.

share|improve this answer
    
Actually, that what I would encrypt eventually /home and /tmp. I'm just testing it so far on the local machine. So, you're saying that if I only encrypt home, then it will not ask me for password on boot? Where the passwords will be stored to unencrypt /homethen and how? –  Ilia Rostovtsev Jan 12 '13 at 20:44
    
I've just tested. It still requires password for /home on boot. Is there a way to encrypt the password and store it some where and then insert it on BOOT? –  Ilia Rostovtsev Jan 12 '13 at 21:01
    
I think wiki.centos.org/HowTos/EncryptedFilesystem will answer most of your questions here. Is there a way to encrypt the password and store it some where and then insert it on BOOT? - this will entirely defeat the purpose of encrypting /home. The main reason for encrypting is if someone breaks into your server room and steals your server, they cannot get access at your data. Since the drive is mounted for read/write during normal server operations, hackers will always be able to access the unencrypted data (and, if you set it up like this, the keys need to decrypt it). –  Jay Jan 12 '13 at 21:09
1  
I'm going to cut to the chase and just say no. If your NOC has physical access to the server, they will always be able to pwn you, no matter how hard you try to prevent it. If they want to mess with you, they can supply you with tampered hardware. So, you need to trust your NOC or just move elsewhere. –  Jay Jan 13 '13 at 0:11
1  
This is my last contribution to this discussion. Powercut was an example, they could say your PSU has failed and need to chassis swap, say the network card failed and requires reinstallation. In most of these cases, NOC have a 4 hour SLA. More than enough time to clone your drives! The fact is, you are at their mercy. I think it's time you accepted that. –  Jay Jan 13 '13 at 20:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.