3 ms·
From you link: >"Servers use full disk encryption and the key must be manually entered at boot." I am curious how do you handle key rotation and storage of en
by bogomipz 9y ago
From you link:
>"Servers use full disk encryption and the key must be manually entered at boot."
I am curious how do you handle key rotation and storage of encryption keys?
- the_stc 9y agoOnly a few people have access to the keys, plus a set of third parties (think lawyers) that have a shard of an SSS setup. Changing the boot key can be done now and then. But we think it is feasible to drop the disks entirely for the main servers. So the disk encryption is an issue for the systems holding our CI and imaging platforms.