0

I have installed Ubuntu Server 16.10 Set up disk encryption with passphrase and installation on whole disk. Now every start or reboot is asking for

Please unlock disk sda5_crypt

Is it possible to run the server encrypted without entering the passphrase every time? I am scared of somebody stealing the server with data. But I need the server to work after reboot too.

Is there a solution for this? Is it necessary to enter the passphrase after reboot or can the system work without it?

closed as too broad by Zanna, user68186, Eric Carvalho, Kaz Wolfe, 2707974 Apr 3 '17 at 7:20

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • This is EXACTLY what encryption is intended for - to prevent unauthorized access to the data by people with physical access to the machine. If that's not your goal, then perhaps encryption isn't the right answer for you. – user535733 Mar 27 '17 at 13:40
  • Sure, but can server operate without asking passphrase at any restart? Is there a way to protect data on working server? – Maximi Mar 27 '17 at 13:49
  • 1
    Encryption protects data at rest. A working server is not at rest - the data is decrypted anyway. Encryption is the wrong solution for that use case. – user535733 Mar 27 '17 at 14:03
  • 1
    A whole-disk-encrypted server CANNOT operate without the decryption key (passphrase). It's that simple. The OS files are encrypted and cannot be used until decrypted. – user535733 Mar 27 '17 at 14:04
  • Yes, you are right. But the big companies such as DigitalOcean and other offers encrypted data storage. What does it mean? – Maximi Mar 27 '17 at 14:05
0

As user535733 commented you cannot have privacy or integrity without authentication. If you could boot the system without a pass phrase then anybody could. However there are other authentication methods like key cards, fingerprint readers or other biometry; all of them require the presence of an authorized operator though.

  • You can also unlock luks via network in initramfs. There are some hooks for dropbear... – Andrius Štikonas Apr 12 '17 at 18:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.