Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I need a webserver (LAMP) running inside a virtual machine (#1) running as a service (#2) in headless mode (#3) with part or the whole file system encrypted (#4).

The virtual machine will be started with no user intervention and provide access to a web application for users in the host machine. Points #1,#2 and #3 are checked and proved to be working fine with Sun VirtualBox, so my question is for #4:

Can I encrypt all of the file system and still access the webserver (using a browser) or will GRUB ask me for a password?

If encrypting all of the file system is not an option, can I encrypt only /home and /var/www? Will Apache/PHP be able to use files in /home or /var/www without asking for a password or mounting these partitions manually?

share|improve this question
    
why do you want to do this? –  akira May 5 '10 at 12:33
    
ship an image to customer with sensible data - our client wants this data to be accessible only through the web browser –  user36159 May 5 '10 at 12:52

2 Answers 2

up vote 8 down vote accepted

If you want full disk encryption, you have to enter the password during the bootphase, which probably is not what you want. I would recommend you create an encrypted partition using luks and put all the sensible data on that partition. After the machine has booted, you can ssh into the box and unlock the partition.

As for how to do the encryption, its very easy:

  • Create the partition as you like
  • Format the partition with luks:

    cryptsetup -c twofish -y luksFormat /dev/sda4
    
  • Unlock the partition with luks:

    cryptsetup luksOpen /dev/sda4 encwww
    
  • Format the encrypted partion with a fs of your choice:

    mkfs.ext3 /dev/mapper/encwww
    
  • You are done and can now mount /dev/mapper/encwww

To unlock the partition again after a reboot you need to do:

cryptsetup luksOpen /dev/sda4 encwww

and then mount the partition.

share|improve this answer
    
Tim - nice solution. thanks –  user36159 May 5 '10 at 14:31
    
Based on your answer, I don't see what's preventing a rogue process that has gained root access from running those commands and seeing your sensitive data. Can you explain? –  trusktr Aug 30 '13 at 4:16
3  
@trusktr no the process would not, because it does not know the password. But after you enter your password it would be able to read all the files. If you have a rootkit on your computer you have of course far more problems at hand. –  Tim Schumacher Sep 23 '13 at 7:59

cryptsetup and dm-crypt isnt available on standard-linux-distributions and it is quite an exotic solution, you should try doing it the normal way:

modprobe loop
modprobe cryptoloop
modprobe aes

dd if=/dev/urandom of=/yourContainerFile bs=`expr 1024 \* 1024 \* 1024` count=yourSizeInGigaBytes

losetup -e aes-256 /dev/loop0 /yourContainerFile

mkfs.ext3 /dev/loop0

aaand now you're ready to mount /dev/loop0 wherever you like - strong encryption, done correctly; you could even config your fstab in a way which allows the encryption-key to be read from a USB-stick which has to be plugged in @ boot ... way more flexible AND secure --> Never follow guides which use "twofish" or something similar as encryption ... this algorithm is not yet fully analyzed, nobody knows if it is secure.

Oh and : if you want security beyond the scope and power of secret agencys : use

/dev/random

instead. The entropy-gathering daemon of Linux delivers statistically "good" values, but it is very slow.

And if you're really paranoid, buy yourself a device which is able to receive & measure cosmic background radiation, connect it to your computer and let it write to /dev/random :-D

share|improve this answer
    
According to en.wikipedia.org/wiki/Cryptoloop, dm-crypt prevents a certain vulnerability (watermarking) that is seen with cryptoloop. What are your thoughts on that? –  trusktr Aug 30 '13 at 6:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.