4 ms·
A trick I've used in the past for secrets on cloud providers: store them in "/dev/shm". Requires init after boot from a trusted source of course. It's absolute
by api 4y ago
A trick I've used in the past for secrets on cloud providers: store them in "/dev/shm". Requires init after boot from a trusted source of course.
It's absolutely not foolproof but reduces the odds of them ending up on a SAN somewhere where they might be found by someone scanning free space or gaining direct access to an iSCSI bus or similar.
- LinuxBender 4y agoAdding to this for completeness sake, if using tmpfs such as the default /dev/shm mount, one must ensure that swap is either encrypted or disabled as tmpfs is swap backed and data not being actively accessed/written can end up in swap on disk.