Best way to protect a server with encryption

Question

I am planning to deploy a server at a customer location, probably either of linux/bsd based system. How can I ensure that the server is protected from data-theft/replication, for eg. someone(maybe customer himself) making duplicate copies of the disk. I understand disk encryption could help, but anyone with a valid passkey can decrypt, is there any way to make it transparent from the user/customer, so that he doesn't have to enter passkey at boot.

Answer 1

The only way I know of is to include the passkey on an unencrypted partition on the hard drive. Hardly secure - the customer could just read that partition.

The only 'secure' way would be to tie the encryption into the hardware somehow so the disks (or images of the disks) can only be used on one set of hardware - maybe use something like the BIOS ID as part of the encryption key maybe? Not quite sure how you'd go about doing this.

Answer 2

You could store the sensitive data on an encrypted partition, then require someone to login through SSH and enter a key to unlock it. Obviously, after a restart, the system will not be working properly until someone unlocks it.

Answer 3

It just won't work that way.

If you want to protect against physical theft, the key must be stored off-site. Keeping it in a special server won't help against someone who can convince your server to reveal the key as if a normal boot was in progress, or modify the boot process to dump the key. (Without revealing the key, there's just no way to unlock the data.)

Also, no matter what software you use, it will still be possible to make a byte-exact copy of the drive's contents, by both the thief and the customer. Some kind of hardware solution would be necessary.

In the end, though, whoever has physical access can find a way to bypass the security.

Answer 4

http://loop-aes.sourceforge.net/loop-AES.README

Look at part 7:

7.    Examples
7.1.  Example 1 - Encrypting swap on 2.4 and newer kernels
7.2.  Example 2 - Partition backed loop with gpg encrypted key file
7.3.  Example 3 - Encrypted partition that multiple users can mount
7.4.  Example 4 - Encrypting /tmp partition with random keys
7.5.  Example 5 - Encrypting root partition
7.6.  Example 6 - Boot from CD-ROM + encrypted root partition
7.7.  Example 7 - Boot from USB-stick + encrypted root partition
7.8.  Example 8 - Encrypted partition using serpent cipher