Imagine you are running a web server on a Virtual Private Server (VPS) hosted in a datacenter. Could the people running the datacenter covertly read files from my VPS's hard disk? Could an attacker or malicious admin who has compromised the VPS provider, take my private SSL key (or other data) loaded into memory (for use by apache) and then use my CA signed key in attacks?
Would disk encryption (say put secret stuff on an encfs mount) buy me anything if my server is running all the time and from the perspective of the VM's guest OS the decryption key is necessarily in memory?
Other than only using my own hardware and hosting everything myself, is there anything I could do to increase my safety against these kinds of risks?
This boils down to can one read the contents of memory or the hard disk of a running (or frozen) virtual machine, if they have full control of the host, but no login/permissions on the VM. Are these real risks (easily done in practice nowadays), something theoretically possible but probably hard/unknown to do in practice, or something probably impossible?
(Please neglect other sources of threats; e.g., the obvious possibility that the VPS provider made you start with a VM that already had secret rootkits/backdoors/keyloggers installed that they could use to compromise your secure data in the normal fashion).