Fwd: Re: [vserver] Encrypted Vservers

From: Laurens Vets <laurens_at_daemon.be>
Date: Thu 26 Mar 2015 - 16:36:39 GMT
Message-ID: <53bc362ffcf22bf22c6a312ef13dbb4d@daemon.be>

Forwarded to list on request by sender.

-------- Original Message --------
Subject: Re: [vserver] Encrypted Vservers
Date: 2015-03-26 01:50
 From: Allan Latham <alatham@flexsys-group.de>
To: laurens@daemon.be

Your best bet is to encrypt the whole host server except /boot.
Your problem is that you need to enter the passphrase during the boot
sequence.

See this which relates to a server farm in Germany. It may point you in
the right direction. I have NOT used this personally so I cannot vouch
that it is 100% right but it is what I would do.

https://kiza.eu/journal/entry/697

BTW. If you don't have physical control of the server even a moderately
powerful adversary can defeat your security. But at least what you
propose defends you from the server farm swapping your disk out after a
failure and then not physically destroying it.

Allan

PS please forward to the list - for some reason I can't post to it any
longer.

On 25/03/15 01:39, Laurens Vets wrote:
> Hello list,
>
> I'm currently looking for a good way to encrypt Vservers.
>
> Basically what I want is that when I start a vserver, it asks for a
> passphrase before booting further. I do not want to encrypt the host
> itself, only the guests.
>
> What would be the best way of doing this and does anyone have any
> experience in this?
>
> Thanks!
>
Received on Thu Mar 26 16:37:04 2015

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Thu 26 Mar 2015 - 16:37:04 GMT by hypermail 2.1.8