A CentOS 7 web server needs encryption at rest. I would like to use LUKS encryption for this, but I need direction to plan how. Can I use LUKS encryption to encrypt the entire drive as one unit on a live web server?

IMy ISP told me that I need to retain two unencrypted partitions, one as the boot partition, and the other to allow CentOS 7 to establish state for the OS. I am thus told that only additional partitions would be encrypted. How do I determine which file system elements to retain in the OS-state partition, and which file system elements to move to an encrypted partition or partitions?

I would like to use virtualbox to set up two CentOS 7 virtual machines on the server.

1.) The first virtual machine would host web apps that have https and smtp connectivity to the internet.

2.) The second virtual machine would host the MySQL databases for the first virtual machine. And the second virtual machine would ONLY be able to connect with the first virtual machine, not with any other computers, devices, networks, or machines, etc.

So then do I have four partitions?

1.) boot partition (how big?)  
2.) OS state partition (how big and what is in it?)
        a.) Is virtualbox running here or in an encrypted partition?
3 & 4) Are the two virtual machines each in their own encrypted partitions?
        Or are the virtual machines bundled into one encrypted partition  
        with the virtualbox program?  

To start answering the question of what goes in which partition, I navigated the terminal to cd / and typed ls -al to show everything in the root directory of the server as follows:

[user@domain /]$ ls -al
total 108
bin -> usr/bin
lib -> usr/lib
lib64 -> usr/lib64
sbin -> usr/sbin

Do the folders listed in ls -al for the / directory include everything in all partitions? If not, what else is there on the hard drive and how do I find it? Also, how do we plan to segregate all possible disk elements into partitions in a scheme for LUKS encryption?

  • Who said that you needed anything other than /boot to be unencrypted? Why would you need something else unencrypted? – Michael Hampton Aug 28 '15 at 19:50
  • @MichaelHampton The ISP customer support rep said that the OS needs to be able to establish state using an unencrypted partition. Also, separately, remember that this is a production web server, if that has any bearing. – CodeMed Aug 28 '15 at 19:52
  • If it's to be a production server, why on earth would you be using VirtualBox? And the only unencrypted partition necessary is /boot itself. – Michael Hampton Aug 28 '15 at 19:57
  • Are planning to run virtualbox for a production server important enough you are considering encrypted partitions? Also what is it you will be hosting that needs encryption? – J.Zimmerman Aug 28 '15 at 20:00
  • @MichaelHampton I am only leasing one dedicated server box, and the data has to be EXTREMELY secure. So I figured I would put the database in a VM. – CodeMed Aug 28 '15 at 20:01

Ok, for extremely secure data you must not use a virtual OS. Point.

The host by nature has access to your memory, that's why. In fact, it's rather the host's one.

However, I get you do this because you want to work with the data rather than just store it. I suggest a middleware component to do the encryption/decryption in memory, so writing is done encrypted only. I.e. use a database that supports this or pipe it through gpg. Hence, full disk enc is not necessary if you care on what may be tampered to get your key.

  • Can you please suggest specific middleware? In case it matters, the database is mysql. – CodeMed Jul 4 '16 at 18:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.