0

I have installed CentOS on my 1U server with LUKS encryption. My question is - is there any possibility for someone to access any of the files on the hard disks if the machine is running and he's on the machine (not logged in)? Even someone with military-grade technology?

I mean if someone has an actual physical access to the machine, turn on the monitor but it asks him for username and password. Can he login into the shell and start browsing the files? Or directly access the hard disk when the computer is running somehow?

I guess when it's turned off he can't because the drive is encrypted and it will ask him for the decrypt password?

Improve this question
2
  • It is possible depending on your system configuration and the tools available to the attacker. Some configurations will make it easier (already logged in root shell) or harder (STIG based config), and nation-state attackers have access to 0-day compromises and fancy hardware tools for capturing memory contents or de-capping chips.
    – Slartibartfast
    Dec 11, 2020 at 19:51
  • @Slartibartfast so if the machine is running and the attacker has a physical access, there's a possibility to hack into the system, never the less it's LUKS encrypted? Thanks!
    – Hristo Torbov
    Dec 11, 2020 at 19:56

2 Answers 2

Reset to default
1

LUKS, in common with many other forms of disk encryption, is for protecting data "at rest", i.e. when the machine is switched off or the disks removed. It provides little or no protection against access from within the running system.

Your hypothetical attacker is unlikely to be able to access data directly on the disk. However, if they can access the running system using some method of entry then LUKS will not protect the data

Improve this answer
2
  • Got it! I'll have to think about server side file encryption when uploading then. Thank you!
    – Hristo Torbov
    Dec 11, 2020 at 20:19
  • I'd like to add that LUKS doesn't protect against someone installing a keylogger (or something similar) that runs at either say the hardware or firmware level. So, if someone has physical access to the computer, they won't be able to get that data at the moment, but would be able to wait until you next login in order to have your information sent to them post login. Then they'd be able to use that key on a dumped copy of your drive they made when they installed the keylogger.
    – Alexis Evelyn
    Nov 16, 2021 at 17:45
0

As LUKS needs to have the master decryption key in RAM somewhere it's possible to read the RAM contents even after the computer has been powered off (using special hardware equipment). So the attacker could extract the master key from RAM and use that to unlock the LUKS device when booting a special media.

It's not likely that your neighbor is able to do that, and it's not very likely that it's done in 20 minutes, but it's possible.

However (just as when having a normal system), anybody could try to break into the system while it's running. Then LUKS does not make a difference.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .