How would you protect files of a VPS (Virtual Private Server) from snooping by the service provider?
LUKS
VPN
Encrypt sensitive files
So how do you decrypt the LUKS vault when you have no sshd running as that thing is not up yet?
Do VPSs typical give you LOM? Honest question. Maybe LUKs isn’t good if you can’t console in.
LUKS, or anything that relies on the server encrypting, is highly vulnerable (see schizo@forum.uncomfortable.business’s response).
Your best bet would be encrypting client side before it arrives on the server using a solution like rclone, restic, borg, etc.
you can but an ssh server in your initramfs.
dropbear-initramfs i guess was the name in debian.
Thanks for the comments. I agree on the general consensus, that once an encryption key enters the VPS, the encryption is compromised.
However, I’m thinking more in practical terms, eg. the service provider doing just casual scanning across all disks of VPS instances. Some examples could be: cloud authentication keys, torrc files, specific installed software, SSH private keys, TLS certificates.
Modern CPUs have some RAM encryption features, but ultimately you’re running on hardware outside your control. Personally, I use full disk encryption (except for /boot) and unlock remotely via SSH, but that only helps against automatic scanning of the storage.
Do you use dropbear and manually input the password to unlock the LUKS partition, or have you scripted something to automate that?
Ultimately, you can’t. Even if everything you’re doing is encrypted, they have access to the RAM that’s holding your encryption keys.
You don’t really. Treat it as totally untrusted
Intel is pushing there “encrypted enclave” which supposedly protects the host from being able to read or write guest memory. However, I have serious doubt as it is a black box system. It also is very problematic when a security issue (or backdoor) is found as your data is basically exposed
Ultimately you are right about this which is sad. I wonder if at some point there could be a zero knowledge cache for https. Maybe double encrypt it and have the client decrypt it fully.
