Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I've got a question about the use of encryption:

I set up a Ubuntu 12.04 server to use it as a router, file server for backups and webserver. Of course, it is probably not the best idea to put backups on the same system as a web server, but it is only for private usage and I don't want to spend too much money.

So I thought it is not a bad idea to set up /home-encryption for the backup-user-account with which I do my backups. But in the same moment, another quesiton arises: Does it still makes sense?

Via SSH, root login is disabled. And access to the /home-folder of that user is reduced to the user itself.

So the only scenario to access the /home-folder is to connect keyboard/display to the server, login as root and change to /home. Or have I overseen a scenario? In case I am right, you can only access the /home-folder from "outside" as the backup-user. But than, encryption also doesn't make sense anymore.

Am I right about that thoughts? Or do you still see a way to access the /home-folder of the backup user so that encryption still makes sense?

Thanks for your help in advance!

share|improve this question

1 Answer 1

up vote 2 down vote accepted

One attack scenario that may be relevant: an account with access to sudo is compromised and subsequently used to (i) modify PAM (authentication) library, or (ii) any of the binaries backup-user-account uses, or (iii) maybe even directly observe a running process to gain knowledge of the encryption key.

Without sudo, I think the only remaining attack vectors are physical proximity (as you mentioned), a compromised user account + local root exploit, or a remote root exploit. If your system is sufficiently powerful, you could set up a number of virtual machines (for example Xen or KVM) for different functions, like router, web server and file server.

If this system is local (at your premises), you could improve the backup scheme with an external hard drive (unplug when not backing up or recovering), or two (rotate).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.