I stand before the following task: A VMWare "template" (based on SLES11) with custom software, that is to be distributed to some clients. They will receive a client specific copy of the template and should import it to their local ESX server. BUT! they should not get any local access!
There are two parts to consider:
1) If the image itself is not encrypted, it could opened while not even running and the data could be extracted or worse: changed. Or somebody could just alter the boot process and start up a SLES rescue image and then mount the image partitions
2) The obvious solution would be to encrypt the virtual disc, and ask for a password at the boot loader (e.g. truecrypt) - but the client should not know the password and I will not enter it on every boot ;)
So the question is: How to encrypt/secure this VMWare image?