1

I am using a CentOS running on a Cloud Hosted Virtual Machine. The cloud hosting service is Digital Ocean. The cloud hosted VM dose not allow you to use full hard disk encryption as it dose not provide the ability to enter a password on booting the device.

To encrypt the device I was going to create a copy of a number of root directories (/lost+found, /run, /srv, /tmp and /var) and swap the encrypted directories in place of the original directories by mounting the encrypted copies in place of the original root directories. I was going to mount the encrypted directory's each time the device was booted.

I was going to use DM-Crypt and LUKS to encrypt and access the directories.

Is this an OK idea?

1

I'd suggest configuring your initramfs to run sshd/dropbear so that you can ssh into your initramfs/initrd to enter the decryption passphrase. Look into the various solutions suggested in SSH to decrypt encrypted LVM during headless server boot?.

  • Thank you for this, I will look into it but I am not working on this issue at the moment and it may take me some time to implement your suggestion. Thank you for your help. – bloopiebloopie Jan 11 '17 at 12:11
0

Have not read the How To yet but I have found the link below and I think it answers my question. Any other input would be greatly appreciated.

https://wiki.centos.org/HowTos/EncryptTmpSwapHome?highlight=%28encrypting%29%7C%28root%29

  • No, it doesn't solve your problem, /var needs to be available early in the startup and its content needs to survive across reboots so neither the start from scratch approach for tmp and swap, nor the delayed mounting described for home will work. – symcbean Nov 10 '16 at 15:35
  • @symcbean Thank you. Can you a suggest an alternative approach? – bloopiebloopie Nov 10 '16 at 15:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.