I've got a question about the use of encryption:

I set up a Ubuntu 12.04 server to use it as a router, file server for backups and webserver. Of course, it is probably not the best idea to put backups on the same system as a web server, but it is only for private usage and I don't want to spend too much money.

So I thought it is not a bad idea to set up /home-encryption for the backup-user-account with which I do my backups. But in the same moment, another quesiton arises: Does it still makes sense?

Via SSH, root login is disabled. And access to the /home-folder of that user is reduced to the user itself.

So the only scenario to access the /home-folder is to connect keyboard/display to the server, login as root and change to /home. Or have I overseen a scenario? In case I am right, you can only access the /home-folder from "outside" as the backup-user. But than, encryption also doesn't make sense anymore.

Am I right about that thoughts? Or do you still see a way to access the /home-folder of the backup user so that encryption still makes sense?

Thanks for your help in advance!

1 Answer 1


One attack scenario that may be relevant: an account with access to sudo is compromised and subsequently used to (i) modify PAM (authentication) library, or (ii) any of the binaries backup-user-account uses, or (iii) maybe even directly observe a running process to gain knowledge of the encryption key.

Without sudo, I think the only remaining attack vectors are physical proximity (as you mentioned), a compromised user account + local root exploit, or a remote root exploit. If your system is sufficiently powerful, you could set up a number of virtual machines (for example Xen or KVM) for different functions, like router, web server and file server.

If this system is local (at your premises), you could improve the backup scheme with an external hard drive (unplug when not backing up or recovering), or two (rotate).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .