How would you protect files of a VPS (Virtual Private Server) from snooping by the service provider?

-3 points

LUKS

VPN

Encrypt sensitive files

permalink
report
reply
3 points

So how do you decrypt the LUKS vault when you have no sshd running as that thing is not up yet?

permalink
report
parent
reply
1 point

Do VPSs typical give you LOM? Honest question. Maybe LUKs isn’t good if you can’t console in.

permalink
report
parent
reply
5 points

LUKS, or anything that relies on the server encrypting, is highly vulnerable (see schizo@forum.uncomfortable.business’s response).

Your best bet would be encrypting client side before it arrives on the server using a solution like rclone, restic, borg, etc.

permalink
report
parent
reply
1 point

Yeah, at least the ones I used have some kind of console/terminal you can use and often you can access BIOS and reinstall the OS if you want.

permalink
report
parent
reply
4 points

you can but an ssh server in your initramfs.
dropbear-initramfs i guess was the name in debian.

permalink
report
parent
reply
1 point
*

Pretty cool!

Android and ChromeOS both also just use fuse for userspace (and user-files) encryption. This could totally be used too.

But of course, if something is not on your RAM it is not safe

permalink
report
parent
reply
1 point

Another option: encrypt a sparse file rather than a disk volume. Mount the file to local filesystem and open and close it there.

permalink
report
parent
reply
5 points

That only works if the decryption is happening on hardware you control. You can not trust any part of the VPS including the memory and CPU

permalink
report
parent
reply
77 points

Depends on your threat model and actual realistic concerns.

Ultimately, if it comes down to it, there’s very little you can do that’s failsafe and 100% guaranteed: the provider has access to your disk, all data in your instances RAM (including encryption keys), and can watch your processes execute in real time and see even the specific instructions your vCPU is executing.

Don’t put illegal shit on hardware you do not physically own and have physical control over, and encrypt everything else but like, if the value of your shit is high enough, you’re fucked if you’re using someone else’s computer.

permalink
report
reply
17 points

I like this answer

permalink
report
parent
reply
7 points
*

I mean, if you’re doing to do illegal shit (eg journalism), it is best done on a VPS. This is what basically every military and cyber mercenary orgs do.

Just make sure you only log into the box over Tor, and configure it to only pass data out over Tor. Use it as a jump box. Even if they compromise it, it should tell them nothing about you useful for attribution

permalink
report
parent
reply
35 points
Deleted by creator
permalink
report
reply
2 points
*

Intel is pushing there “encrypted enclave” which supposedly protects the host from being able to read or write guest memory. However, I have serious doubt as it is a black box system. It also is very problematic when a security issue (or backdoor) is found as your data is basically exposed

Ultimately you are right about this which is sad. I wonder if at some point there could be a zero knowledge cache for https. Maybe double encrypt it and have the client decrypt it fully.

permalink
report
parent
reply
2 points
*

Link?

permalink
report
parent
reply
1 point
Deleted by creator
permalink
report
parent
reply
7 points
*
Deleted by creator
permalink
report
parent
reply
17 points

Encrypt them before they’re ever put there. One example I can think of is in resilio sync, which has the option for sharing a folder to an encrypted peer. Other peers encrypt it before sending anything, that peer doesn’t have the decryption keys at all.

permalink
report
reply
7 points

Ultimately, you can’t. Even if everything you’re doing is encrypted, they have access to the RAM that’s holding your encryption keys.

permalink
report
reply

Linux

!linux@lemmy.ml

Create post

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

  • Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
  • No misinformation
  • No NSFW content
  • No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

Community stats

  • 8K

    Monthly active users

  • 3.7K

    Posts

  • 48K

    Comments