LUKS encryption with cloud-init with only one drive sda
Posted by Pandoks_@reddit | linuxadmin | View on Reddit | 7 comments
I'm using a Hetzner vps running Ubuntu 22.04. I have a cloud-init config that sets everything up (firewalls, users, hardening, etc). The only thing that I don't have is disk encryption. I want to fully automate everything meaning that I don't want to go on the Hetzner website to configure things (using IaC to manage my boxes) and I also don't want to ssh into the box.
Is there a way to use LUKS to encrypt sda or at least some of the important directories (maybe a way to partition the disk) as a script I can run in cloud-init?
d_maes@reddit
Aside from they "why" question already raised by others, you'll have to build your own image (e.g. with packer) with encrypted partition, can't encrypt a live partition.
tinycrazyfish@reddit
Technically, you're not wrong. But there is a thing called overlay root. You build your encrypted overlay on top of a standard Ubuntu/Debian installation. You still need a way to manage encryption keys. So unlikely you can make totally unattended.
https://spin.atomicobject.com/protecting-ubuntu-root-filesystem/
michaelpaoli@reddit
How are you going to manage the key(s)/password(s)/passphrase(s) to unlock and access your LUKS data? Where are you going to have those such that you can introduce them in the boot process to unlock and access your data that's LUKS encrypted?
If you're going to stick that on same drive - e.g. sda in the clear, e.g. on the /boot filesystem, you haven't really done much to protect the data if the drive is stolen - as the keys would be readily available on the same drive.
So ... how are you going to manage that to boot? Type 'em in every time you boot? Feed that data into the boot process from somewhere else? Where, exactly, and how?
glotzerhotze@reddit
Using an initrd with dropbear would allow to ssh into the machine to paste a decryption key. That‘s the manual approach, automation would be more tricky.
archontwo@reddit
You might want to checkout this if you are paranoid about sharing keys.
One caveat though. Remember, the cloud is just someone else's computer you do not have full control over. So even fully encrypting a virtual disk and keeping the key elsewhere is no guarantee that the hosting provider cannot just take a memory dump or snapshot of your disk after it has been decrypted.
Trash-Alt-Account@reddit
if you're gonna automate decryption to the point of zero manual intervention then what's the point of encrypting it?
Pandoks_@reddit (OP)
it’s mainly just to make sure when i stop using the box, the data can’t be recovered or if there’s some crazy infiltration into the server rooms. if they have access to os that’s a whole different problem.
ended up partitioning my sda to have one more partition and encrypting it. used symlinks if needed to access anything in the encrypted partition