I use a headless server connected to nothing but an ethernet cable in my basement, and I’d prefer to allow the thing to boot by itself and start up without me needing to unlock the disk encryption every single time I do an update or power back on. Its a Dell 9500t NUC that I’m using it as a server and am wondering whether its possible to encrypt everything still.

I do generally use docker containers, so could I potentially encrypt just the containers themselves, assuming I’m worried about a smash and grab rather than someone keeping the machine powered up and reading my ram?

  • theunknownmuncher@lemmy.worldEnglish
    31·
    4 months ago

    If it can power up and decrypt the docker volumes on its own without prompting you for a password in your basement, it will also power up and decrypt the docker volumes on its own without prompting the robbers for a password in their basement

      • ryokimball@infosec.pubEnglish
        9·
        4 months ago

        First reason I think of to use fde all the time even if it’s automatically unlocked, is it’s simple to securely delete everything all at once. Just delete all the keys or overwrite that section of the desk.

        • catloaf@lemm.eeEnglish
          32·
          4 months ago

          Depends on how you want to define “securely”. A sufficiently motivated attacker could attack the remaining encrypted data, either through brute force or exploiting a weakness in the algorithm.

          • ftbd@feddit.orgEnglish
            5·
            4 months ago

            If you find an encrypted drive, it’s extremely unlikely you can recover anything from it. If there is no LUKS header, it’s pretty much impossible.

  • partial_accumen@lemmy.worldEnglish
    21·
    4 months ago

    assuming I’m worried about a smash and grab

    For your specific use case, how about this:

    Get a cheap USB thumb drive and a long USB cable. Put your disk unlock password on that thumb drive, and semi-permanently affix the USB drive to your building. You said you’re in a basement. Put it on top of a rafter with a metal fitting that would keep the drive from being taken without removing the screws. Run the long USB cable from the thumb driving in your rafter to the USB port on the machine. Alter your startup script to mount the thumb drive read the password from the thumb drive to unlock your main disk. Don’t forget to immediately unmount the thumbdrive in the OS after the disk is unlocked for extra safety.

    If someone is doing a smash and grab, they’ll unplug all the cables (including this USB cable going to the thumb drive) and take your machine leaving the disk encryption password behind on the USB thumb drive.

  • I2jgwh0hYtxrCZQ@lemmy.sdf.orgEnglish
    7·
    4 months ago

    I read somewhere someone had their encryption key on their phone / another server and had the server pull the key via ftp on boot. Then the server and encryption key is separated but can decrypt its self as long on the ftp server is available.

    Edit - might have been unraid where the OS and data drivers are separate

  • spv.sh@lemmy.spv.shEnglish
    4·
    4 months ago

    surprised no one has mentioned dropbear yet. i don’t remember the name off the top of my head, but there’s a relatively easy way to setup your initramfs to listen for SSH connections, authenticate with a private key, and send the unlock key. bonus points for writing a script to do it automatically with cute names, e.g. “sendkey helium.intra” or whatever

  • ryokimball@infosec.pubEnglish
    1·
    4 months ago

    Yes, you can have docker scripts decrypt a drive/storage. You might also consider an encrypted home partition separate from the root partition, or user space encryption of your home directory.