Re:Unlocking an encrypted rootfs over ssh-server in initramfs
by tarnacious_ on Wednesday January 20, 2016 @01:24PM
(#10940159)
> It is very irresponsible to make statements like that.
I don't think so. It is irresponsible to suggest that you can secure a server you don't physically control. Full disk encryption doesn't protect your disk if someone can take a memory dump of the machine. Using sshd in an initramfs to receive the passphrase for an encrypted rootfs doesn't help if someone can modify the initramfs and wait for a the passphrase.
Encrypting your volumes does provide some security, but having to SSH into an initramfs to unlock the root partition has its own problems.
Re:Unlocking an encrypted rootfs over ssh-server in initramfs
by jerguismi on Wednesday January 20, 2016 @02:45PM
(#10940782)
Nothing is ever 100% safe and everything has its own problems. Initramfs-based full disk encryption is easy and effortless to do, and the value is most definitely greater than the effort required. I know multiple of cases where a simple FDE would have helped to greatly reduce the harm done.
You can host your own servers, but even that is not 100% safe. Someone can break to your hosting space and inspect the servers. And that of course requires quite a deal of effort.
It is very irresponsible to make statements like that. It is very common to have an attack, where the attacker gains access via social engineering to a server, and manages to restart the server and gain access to a rescue system.
And even then, nowadays renting servers is very common - how do you know you can trust everyone in the hosting company? FDE should be the default thing to do, especially for servers. I don't really understand why they aren't a standard practice already.