2

I have a server which has 'loose' physical security (somewhat easy for the entire server to get stolen).

For the sake of the question, let's assume that anyone can access the server physically, what precautions should I be using to keep the data secure?

My initial thought would be to keep all logs, databases, user content, etc. in an encrypted TrueCrypt container. This means that if the hard disk/server is stolen, they will be unable to access the private data. However, what if someone plugs a screen and keyboard into the server? If I am currently logged in via SSH, does that leave the server vulnerable locally? Can I trust Linux's standard "enter password" prompt or can that easily be bypassed?

I'd like to be able to boot and access my server remotely without being forced to enter a password locally (for example if the OS was encrypted)

Thanks for your help

2

Anyone having physical access to the server can plug a rogue PCI device in it, e.g. containing the Rakshasa malware which will infect the BIOS thus bypassing any full-disk encryption by logging your key's password (implement a rogue forged SSH server, phishing style). Attacker will then have a complete and remote access to the system, while remaining invisible to the OS because the malware runs in System Management Mode. Rakshasa was developed by Jonathan Brossard and presented at Defcon 20 and Black Hat and is a sadly powerful framework.

This (capturing the encryption passphrase) is also known as the Evil Maid attack researched by Johanna Rutkoswka at Invisible Labs.

Johanna propose a mitigation through TPM.

1

1st identify what to secure and where it is stored.

If you have Physical access to server, you can use LUKS which has support built in Linux Kernel. LUKS can do the AES 256 encryption same as TrueCrypt. Passphrase can be enter during boot up to mount the drive, if you have physical access. In that case, if your hard disk is stolen, they will not able decrypt data without your passphrase.

To keep ssh secure

  • Limit who can access the IP with SSH port by an external firewall
  • Limit SSH access from iptables (as 2nd layer firewall).
  • Limit name of users who can access by SSH and no root logins (Can be setup in /etc/ssh/sshd_config)
  • Use Key Pair authentication or Two factor authentication
  • Install an anti-password-brute-forcer like fail2ban
  • Make sure system is running with support OS by vendor with latest patches.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.