Subject: Fwd: Re: [vserver] Encrypted Vservers
From: Laurens Vets <laurens@daemon.be>
Date: Thu, 26 Mar 2015 09:36:39 -0700

Forwarded to list on request by sender.

-------- Original Message --------
Subject: Re: [vserver] Encrypted Vservers
Date: 2015-03-26 01:50
 From: Allan Latham <alatham@flexsys-group.de>
To: laurens@daemon.be

Your best bet is to encrypt the whole host server except /boot.
Your problem is that you need to enter the passphrase during the boot
sequence.

See this which relates to a server farm in Germany. It may point you in
the right direction. I have NOT used this personally so I cannot vouch
that it is 100% right but it is what I would do.

https://kiza.eu/journal/entry/697

BTW. If you don't have physical control of the server even a moderately
powerful adversary can defeat your security. But at least what you
propose defends you from the server farm swapping your disk out after a
failure and then not physically destroying it.

Allan

PS please forward to the list - for some reason I can't post to it any
longer.

On 25/03/15 01:39, Laurens Vets wrote:
> Hello list,
> 
> I'm currently looking for a good way to encrypt Vservers.
> 
> Basically what I want is that when I start a vserver, it asks for a
> passphrase before booting further. I do not want to encrypt the host
> itself, only the guests.
> 
> What would be the best way of doing this and does anyone have any
> experience in this?
> 
> Thanks!
>