1

I've gone through a related question on how to protect data in case of unauthorized physical access to a server, where the consensus seemed to be that preventing data access when someone has physical access to the server (the machine is turned on and running applications) is nearly impossible. Despite this, I'm still exploring potential solutions.

I recently set up a local server to run Nextcloud and Bitwarden, intending to store all my crucial data at home. Everything is functioning well, and I've installed Ubuntu Server with full disk encryption. However, I'm determined to make it extremely challenging for anyone with physical access to my server to retrieve information.

I believe that full disk encryption may not be foolproof because the server is always running, meaning the decryption information is already loaded into memory.

I take data security seriously and am considering extreme scenarios, such as government or law enforcement gaining access to my local server at home. Currently, to run any application, I must be logged into the server, making it accessible to anyone who gains physical access.

What options do I have to prevent data access for someone with physical access to my server? While full disk encryption suffices when the server is turned off, how can I safeguard sensitive data when the server is running and physically accessible? Is there a method to store decryption information on my notebook, where I log in to the server via SSH, ensuring that decryption occurs on my notebook?

Finally, I came across this question with informative answers. However, the solutions provided seem complex given my current understanding. I'm contemplating a solution that may not be as robust but could still significantly impede or make it nearly impossible for someone with physical access to my local server, while it's turned on, to read sensitive data.

Improve this question
3
  • 4
    Physical problems are often solved using physical solutions. This is why most data centers that offer server co-location provide their customers with locked cabinets, CCTV monitoring, card swipe access to server rooms, etc.
    – mti2935
    Commented Jan 6 at 16:04
  • And what do you mean with psyhical access? Logon to the console?
    – Turdie
    Commented Jan 6 at 16:55
  • 1
    @Turdie Ubuntu as I mentioned. The physical access would be access to the notebook where I am running my local server. Right now it must be logged to run the applications.
    – Lucas
    Commented Jan 6 at 18:07

1 Answer 1

Reset to default
-1

Latest AMD (Secure Memory Encryption)/Intel (Total Memory Encryption) CPUs support full memory (RAM) encryption. You enable it in BIOS settings.

You store your decryption key in TPM or enter it once on boot. Then you're good to go.

Even if someone has full physical access to your system, I cannot think of any options to get access to your data unless they temper with the boot loader. In order to avoid this you can boot off your trusted USB flash drive.

Mind that once the attacker has been confirmed to actually have accessed your system you can no longer trust its safety/security: the attacker could have compromised your keyboard by planting a HW key logger.

Improve this answer
2
  • Iff there is no locally exploitable vulnerabilities in the operating system.
    – vidarlo
    Commented Feb 6 at 14:55
  • "I cannot think of any options to get access to your data" ... dont worry, im sure someone else has that covered.
    – CaffeineAddiction
    Commented Oct 3 at 15:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .