I have a linux system running at a cloud provider where I created an encrypted container using LUKS to store personal data.
The encrypted container is manually mounted at
/srv; the rest of the system is unencrypted so that the server and especially the ssh daemon start automatically on system boot.
At the moment, if the server restarts (because of an update that requires a restart or because the host system where the droplet runs required a restart) I need to manually open the LUKS container and start the services that store data in the encrypted partition (dovecot, mysql etc.). Of course, this is the logical consequence of having an encrypted partition. But I was wondering if I can automate this in a secure manner.
I do not want to store the passphrase on the server for obvious reasons. So I wrote a little script that runs on a Raspberry Pi at home: It ssh-es every 5 minutes into the server and checks if the Loopback Device is mounted. If not it mounts the container (relevant lines of the script, this is only executed if
/srv is not mounted):
# Mount Srv Container ssh root@<ip> "echo -n '*** my passphrase ***' | cryptsetup luksOpen /root/srv_container_file container -" ssh root@<ip> "mount -t ext4 /dev/mapper/container /srv" # Start Services that store data on /srv # ...
The approach works but it feels super hacky. Not sure if the constant connections, aka active checking, are a good idea and I am also not sure if I am opening myself up to vulnerabilities by echoing my passphrase into
Thus my question:
What is a good/standard way to automatically open the LUKS container without storing my passphrase on the server and without opening up my system to vulnerabilities (compared to manually opening the container)? References to official documentation are very welcome.
What am I trying to protect myself from?
- I don't know how the cloud provider handles old and/or faulty disks. I don't want anyone to read my data from the physical disks or backups made by my cloud provider.
I don't know if my disk image gets moved on the physical storage (according to the docs of my provider it's stored redundantly), so I don't want anybody who has access to those blocks after me to be able to restore the data.
I know that once an attacker has shell access to my running system it is game over as the partition is open and not passphrase is needed.