9

I have set up our new server at work to have an encrypted HDD. At start up it asks for our password before booting. Great. Except it has just dawned on me that we ssh in to the server all the time. What if I need to restart the machine remotely or the power goes out over the weekend.

Is there a way around this? I would still like to have the entire disk encrypted.

Thanks

1

2 Answers 2

7

There is no safe way around this.

Either you:

  1. Enter the password automatically. Thus negating the security.
  2. Or you manually enter it at boot.
  3. Or you manually enter it after booting a small unencrypted partition.

The last allows you to boot a minimal system into which you can SSH and then manually mount the partitions with protected data, but it also weakens the security because people can compromise this unencrypted part and wait for you to enter the encryption password.

If your server is equipped with a remote management feature (E.g. Dells DRAC, HP ILO etc) and that is on a secure network then you can also consider using that to remotely grab the console and enter the password (A sort of remote option 2). That assumes you trust the remote management features and network.

1
  • yes I thought that this would be the case. I just needed it confirmed. Thank for your suggestions.
    – Caustic
    Mar 28, 2013 at 12:05
1

Yes, there is a way around this, see Takkat's comment. You need dropbear and busybox in initramfs so that you can ssh into machine and enter password. See above link for details.

(your /boot partition is unencrypted anyway, I suppose)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .