2

I know it is impossible to completely prevent a host from accessing the data of a virtual machine (as noted here, here and here), but I think there is value in making it harder to do so. Bare metal servers aren't always an option, and they are much more expensive.

Here is the threat model I have in mind:

  • Buy a VPS from a fairly small company, maybe even one managed by a single person
  • Harden the VPS as much as reasonably possible
  • Rogue government entity demands all the server's data
  • The company may not have the time, knowledge or resources to circumvent the hardening
  • The company provides only the encrypted data to the government entity

Of course, said government entity could simply demand direct access to the host machine, but even then, it may still require them a good amount of time to figure it out, by which point the VPS owner may have caught on to what's happening and wiped it clean.

This leads me to my question. Given the typical steps a system administrator may take to obtain data from a virtual machine, what could one do to make this process harder?

Edit: Here is what I have done so far: encrypt the boot partition (GRUB bootloader supports encryption), encrypt the root partition, encrypt the home directory w/ unmounting on logout, use linux-hardened, disable USB via kernel parameters (I am unsure if this helps?)

Improve this question
3
  • You can encrypt the disks (if it's an OS that you can install/set up). This will only help if they don't snapshot the running VM and instead give the cold disk files to some adversary. You'll need some way of remoting in and unlocking the disk with the encryption key if it ever crashes.
    – user
    Commented Nov 4, 2019 at 18:11
  • @user Yes, the assumption was that the OS would already be full-disk encrypted, or else it would be trivial for the VPS provider to access the data. Let me clarify in an edit.
    – Michael Baker
    Commented Nov 4, 2019 at 18:13
  • Disabling USB won't really do much on a virtualized server, that's more important on bare-metal servers where an adversary can walk up and plug some malicious device in. If you want it generic then there's probably no harm in leaving it disabled.
    – user
    Commented Nov 4, 2019 at 18:22

1 Answer 1

Reset to default
4

  • Buy a VPS (the StorageVPS), create a 50GB file full of zeroes, export this file using SSHFS.

  • Buy another VPS (the ApplicationVPS) on another jurisdiction, mount that file, use LUKS to create an encrypted filesystem.

  • Use different identities for each one, so neither one nor yourself are on the same country (or group of friendly countries).

If the admins on StorageVPS get that 50GB file, it's just a large blob of unreadable data. They don't have the LUKS key, so they cannot decrypt anything. The admins on ApplicationVPS can have the key (they own the server after all), but being on another jurisdiction will complicated things a little for the government trying to read your data.

You will have latency issues, but your data will be a little safer.

Improve this answer
2
  • Would SSHFS be better than tunneling NBD over SSH?
    – user
    Commented Nov 4, 2019 at 18:37
  • You can use anything: NBD over SSH, NFS over wireguard, HTTPFS... Test latency and throughput of each solution, use the one you like the most.
    – ThoriumBR
    Commented Nov 4, 2019 at 19:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .