3 ms·

> Well, yes - if you are using an encrypted rootfs on a server, the disk is permanently in an unlocked state - so it doesn't completely matter if encrypted or

> Well, yes - if you are using an encrypted rootfs on a server, the disk is permanently in an unlocked state - so it doesn't completely matter if encrypted or not. It is very irresponsible to make statements like that. It is very common to have an attack, where the attacker gains access via social engineering to a server, and manages to restart the server and gain access to a rescue system. And even then, nowadays renting servers is very common - how do you know you can trust everyone in the hosting company? FDE should be the default thing to do, especially for servers. I don't really understand why they aren't a standard practice already.

tarnacious_ 11y ago
> It is very irresponsible to make statements like that. I don't think so. It is irresponsible to suggest that you can secure a server you don't physically control. Full disk encryption doesn't protect your disk if someone can take a memory dump of the machine. Using sshd in an initramfs to receive the passphrase for an encrypted rootfs doesn't help if someone can modify the initramfs and wait for a the passphrase. Encrypting your volumes does provide some security, but having to SSH into an initramfs to unlock the root partition has its own problems.
- jerguismi 11y ago
  Nothing is ever 100% safe and everything has its own problems. Initramfs-based full disk encryption is easy and effortless to do, and the value is most definitely greater than the effort required. I know multiple of cases where a simple FDE would have helped to greatly reduce the harm done. You can host your own servers, but even that is not 100% safe. Someone can break to your hosting space and inspect the servers. And that of course requires quite a deal of effort.