I am looking for a transparent, full-partition encryption solution for a Linux system which
- allows to boot unattended (reboot, restart after loss of power, etc.)
- allows to make the partition permanently unavailable almost instantly, both from the system itself as remotely via ssh, by e.g. overwriting a passphrase file, an encryption header, random parts of the filesystem etc.
- is relatively easy to set-up and maintain.
The system we're using right now is a standard NixOS system on which we run a bunch of docker containers. I'm thinking now to leave the root partition unencrypted and have a second, encrypted data partition mounted on
/var/lib/docker. LUKS/dm-crypt seems like the most straightforward solution for full-partition encryption. This partition would be auto-mounted with a plain-text key file stored on the (unencrypted) root partition.
So I am not that much concerned about securing the system from theft or access of the data at rest, but I want to be able to make the whole partition permanently inaccessible quickly in case of a physical security breach.
I'm therefore looking for some advice as to how to make the encrypted partition unavailable with only a small number of file operations.
- Can I overwrite the key file in some way which makes it unlikely enough that it can be recovered still from the hard drive? What would be the most appropriate way to do so?
- Alternatively (or additionally), can I reliably overwrite the partition header or something to further decrease the likeliness of an attacker recovering the contents of the partition?