I am looking for some recommendations on how to secure the data of my physical servers (against physical theft), that I am about to set up. I am new to selfhosting but have a few years of experience running Linux on a desktop.

My usecase is a simple debian(?) server at home with Paperless ngx and Tailscale for when I am away from home.

The question is how to encrypt the data while still being able to keep the server updated.

Coming from Desktop my first thought was to simply enable FDE on install. But that would mean supplying the password everytime the server needs to reboot for an update. Could someone provide some insights on how often updates to debian require a reboot?

My second thought was to use an encrypted data partition. That way the server could reboot and I could use wireguard to ssh in and open the partition even when I am away from home for a longer time.

I am open to other ideas!

  • ryokimball@infosec.pubEnglish
    7·
    4 days ago

    This has been on my mind, I have yet to do it but the implementation seems trivial.

    You can use typical luks full disk encryption with a password. Luks actually has five password slots. Passwords do not have to be actual text, they can be a file or even part of a file.

    So my idea is, buy some really cheap, low profile USB flash drives and store some seemingly innocuous data like cat pictures or public domain books, IDK and it doesn’t matter what the actual data is. Use full disk encryption and set a regular password, then add a second password that is a file or part of a file that lives on the flash drives, and have it set up to look for that file on boot as an option for unlocking.

    Now the disc is fully encrypted but will boot/reboot without interruption as long as the flash drive is installed. You can remove the flash drive when you’re feeling paranoid, or even better only install it when you are going to be away for a while. If you leave with the machine having the flash drive but are feeling worried, you can remote into the machine and edit / delete the file or just clear the key slot from Luks.

    That’s what’s been on my mind, anyway. I think the typical suggestion/solution is to just use drop bear and remotely unlock using that, or don’t use full disk encryption and selectively encrypt your data instead (partitions or userspace encryption).

    I’m not going to proofread this so I hope it makes sense

    • ladfrombrad 🇬🇧@lemdro.idEnglish
      1·
      6 hours ago

      I like this, and I suppose it’s a shame a Rasp Pi can’t be WOL’ed.

      But could another SFF single use/secured device on the same network that doesn’t have FDE, also provide that key only if and when you wake it up (manually decrypt the file after ssh’ing into it too?) instead of having a USB drive directly plugged into the main server so, if a nefarious person does have away with the main bounty they’re fugged without said second hidden device on the same network?

      ninjaedit: I also at one point in the past did Wireless WOL (wireless NIC’s with WOL were prohibitively expensive at the time of me playing) via a Travel router that was acting as an Access Point, simply to wake up forward the magic packet. You could really hide that thing 😇