Share Encryption in Ubuntu
reddit / selfhosted

----------------------------------------------------------------------
Yanni_X · 2023-11-01 23:55

Hey Self-Hosters!

Maybe i find someone who knows both systems: I have a Synology DS with
DSM6.x... and i have enabled share encryption for shares including
sensitive data. The key is only stored on an USB stick that's secured
with me. If i reboot the DS i have to put the stick in beforehand so
that the shares get unlocked automatically.

​

Now my problem: I also have a mini-pc running Ubuntu as a Server. I
also want to encrypt important shares (e.g. docker-vol of vaultwarden)
securely so that they have to be mounted at startup. So similarely
they should get mounted automatically when booting while the stick is
plugged in. And the best would be if both systems could use the same
stick as a keystore

​

Does someone know if this is possible and how? I can only find
tutorials where either the key is present on the disk itself (duh...)
or you have to manually mount it after a startup.


My last reserve work-around would be to mount NAS-shares as networks
drives in the Ubuntu-Server so that the Server never keeps sensitive
data itself...

----------------------------------------------------------------------
DaRealCompten · 2023-11-02 10:22

I am using LUKS to encrypt my shares.

And it has the ability to automatically encrypt the shares with a
keyfile. And you can add an existing keyfile to the encryption.

I'm not sure what you are using, but if it's just a keyfile on a USB.
You would have to mount the USB, and pass the keyfile to unlock the
others and then mount the encrypted drives.

----------------------------------------------------------------------
zakgrant · 2023-11-02 15:40

Take a look at https://github.com/latchset/clevis it has been bullet
proof for me. Yes it may seem complicated at first but honestly this
is the most simplistic way I have came across to deal with auto
unlocking encrypted volumes.