Do you encrypt your home servers' drives, with what and why? reddit / selfhosted ---------------------------------------------------------------------- Simon-RedditAccount · 2023-12-10 10:09 Also, if yes, do you use auto-unlock? Some threat modelling from your perspective would be also interesting. ---------------------------------------------------------------------- YourNightmar31 · 2023-12-10 10:12 No i don't. I don't see the need for it. ---------------------------------------------------------------------- WiseCookie69 · 2023-12-10 10:18 No. And if you do use auto-unlock, that kinda defeats the purpose anyways. But i also don't RMA my drives. If they die, their NAND modules make friends with the drill. ---------------------------------------------------------------------- IceOleg · 2023-12-10 10:20 Yes, with LUKS. I type my password on boot. I want data secure in the case my home gets broken into and computer stuff is stolen. It also makes eventual disposal of disks worry free. Even as is, the data is secure, and if I clobber the LUKS header the data is as good as gone. ---------------------------------------------------------------------- Alternative_Case_878 · 2023-12-10 10:25 Many people are surprised by the engagement of Serena Williams and Alexis Ohanian, but not me. If I founded reddit I'd be searching for better servers too. ---------------------------------------------------------------------- 8484215 · 2023-12-10 10:29 Yes, LUKS. For the same reason as already stated - crypto at rest if somebody breaks in and steals my hardware. Key entry via a hidden pi zero w that serves keyfile at boot. ---------------------------------------------------------------------- usrdef · 2023-12-10 10:32 LUKS on Linux is more than enough. On Windows, Bitlocker. Backed with a Yubikey. ---------------------------------------------------------------------- SomeOddCodeGuy · 2023-12-10 10:39 When I was in college, someone broke into my apartment while I was gone and took some stuff. The apartment felt safe and secure; but after they broke in, I realized how truly effortless getting into a locked home is. Door locks, window locks, etc are just a deterrent for honest people. If someone ever walks off with my drives, I at least only want them to have my hardware and not my data, too. ---------------------------------------------------------------------- DissonantGuile · 2023-12-10 10:39 > Key entry via a hidden pi zero w that serves keyfile at boot. Could you please elaborate on this setup? Sounds very interesting ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 10:43 Its not slower, but sure more complex. It is only useful if you care about a raid and someone taking your stuff with them and you don't want that data exposed or if you host your data on a public cloud and don't want that they have access to it for free. ---------------------------------------------------------------------- gargravarr2112 · 2023-12-10 10:45 No. There is very little point in encryption-at-rest in a server setting. About the only scenario it protects you from is someone physically stealing the HDDs. If you can access the data, so can hackers. I focus my efforts on securing access to the unencrypted data. ---------------------------------------------------------------------- ElevenNotes · 2023-12-10 10:46 I use encryption at rest and in transit in vSAN since it's available. I don't have any illegal data, but I want to protect my and my clients data from any 3rd party access in case they should decide to swat me and take my data centres with them. There is almost no performance impact but a piece of mind. On dedicated hosts I use LUKS. ---------------------------------------------------------------------- zedkyuu · 2023-12-10 11:14 Yes, but mostly to not have to worry about what is on the drives if they die or I send them in for RMA or give them away or something like that. I once had things set up to fetch decryption keys off of Amazon KMS (to enforce that only my local network could unlock the drives) but decided that I wasn’t that worried about that. I use ZFS encryption. This simplifies remote backup: I send encrypted snapshots and don’t store keys on the remotes. ---------------------------------------------------------------------- 8484215 · 2023-12-10 11:22 Most of my unraid server disk's have both a password and keyfile set up in two of the LUKS slots. The pi zero w holds a copy of the keyfile - only a wall wart for USB power, available over wifi, hidden in a cupboard so burglar won't find it, set firewall and SSH to only allow a keypair login from the unraid server IP and limited to an SCP command. Unraid server go script that it runs on boot copies the keyfile from the pi into memory so when it goes to auto start the array it can unlock each of the physical drives. So unraid drives are crypto at rest if physically stolen. Server boot and array start can still happen without intervention. Extra layer isn't totally secure but is an easy extra layer that adds difficultly to one attack vector without compromising other vectors. ---------------------------------------------------------------------- eattherichnow · 2023-12-10 11:24 Yes. I don’t have armed guards who are loyal to me to the point of giving their life and having a heart attack from just thinking about snooping, so I do care about my drives at rest. Of course someone could keep the server alive at the process but that’s harder. And if you BitTorrent suse Linux you have stuff to worry about - it’s not likely but setting up LUKS is easy and fast. Having to interact at boot is not a huge hassle unless you host something like email at home ---------------------------------------------------------------------- Simplixt · 2023-12-10 11:29 Yes my compete proxmox server is encrypted via luks You can remotely unlock via dropbear SSH while booting, so be excuses not too do it ;) ---------------------------------------------------------------------- zcapr17 · 2023-12-10 11:37 Absolutely. I realistically expect my home to be broken into and cleaned out of tech devices and other valuables at least once in my lifetime, so any device that holds my personal data is encrypted to mitigate the risk of physical theft. I generally use the native encryption solution supported by each OS. One compromise for servers, is that I use clevis & tang for auto-unlock as I need them to come up automatically after a power failure. The tang server runs on a RasPi Zero that is physically hidden (hence very unlikely to be stolen during a break-in). * Main server (Linux): LUKS, with Clevis for auto-unlock. * Synology NAS: Native share encryption, with Clevis for auto-unlock. (needed to compile clevis manually and write helper script to unlock each share). * Laptops and Gaming PC (Windows): Bitlocker with manual password input. * Mobiles (iOS): Native iOS encryption with passcode/FaceID. ---------------------------------------------------------------------- QuickYogurt2037 · 2023-12-10 11:39 Came here to mention this setup, it's definitely amazing! ---------------------------------------------------------------------- zcapr17 · 2023-12-10 11:39 I take it you're using clevis-luks and binding to a tang server on the RasPi Zero? ---------------------------------------------------------------------- DissonantGuile · 2023-12-10 11:42 Very informative, ty. What is the unlocking process? Does the pi boot script send the key over, run a script using the key to unlock the drives, then delete the key? I have a few pi zero Ws collecting dust, I'd like to mess around with this setup. ---------------------------------------------------------------------- rayjaymor85 · 2023-12-10 11:46 I use LUKS yes. \> do you use auto-unlock? That would defeat the purpose. The reason I use LUKS is so that if my equipment is stolen the data cannot be recovered. ---------------------------------------------------------------------- kring1 · 2023-12-10 11:49 Makes it easier to RMA a broken disk. Double so if the disk is to broken to be wiped. ---------------------------------------------------------------------- 8484215 · 2023-12-10 11:52 I looked at clevis and tang but too complex and overkill for home. Just doing simple scripted file pull from the unraid side at boot. ---------------------------------------------------------------------- 8484215 · 2023-12-10 11:54 Unraid initiates the transfer. It has a script that it runs on boot and pulls the keyfile off the pi ready for array start. Keyfile only goes to ram on the server, not written to disks. ---------------------------------------------------------------------- Joniator · 2023-12-10 11:54 Why do you have to destroy the header, does it keep unencrypted track of some file system data? Or just in case someone lucky gueses the code? ---------------------------------------------------------------------- Simplixt · 2023-12-10 11:59 Synology allows now full volume encryption with auto unlock via KMIP Server in the same network. That's working great, I'm hosting one via docker container ---------------------------------------------------------------------- DissonantGuile · 2023-12-10 12:03 Ah okay - that clears things up for me, thanks! Very cool setup ---------------------------------------------------------------------- razorpolar · 2023-12-10 12:06 I use LUKS with dropbear ssh configured in initramfs so when the server boots up I can easily run "ssh myserverluks" from my PC to enter the LUKS passphrase and continue booting. I'm very interested in Ubuntu 23.10 bringing TPM-backed full disk encryption to the masses similar to Bitlocker as I'd much prefer to use the TPM for auto-unlock providing it was secure enough, time will tell how the community responds to it though. ---------------------------------------------------------------------- 8484215 · 2023-12-10 12:13 No probs, happy to help. From memory the original concept came from a spaceinvaderone video that used SFTP so wasn't as secure. Bit of modification to add a little more security but still stay fairly simple. ---------------------------------------------------------------------- IceOleg · 2023-12-10 12:23 The header contains the master key to the encryption, encrypted against the unlock password. Cracking the master key itself is not realistically possible, but it might be possible to get at it with my password. If my password has been leaked for some reason and is in some leaked passwords database, then testing the disk encryption against the known passwords in the database will eventually get the disk open. Destroying the header means knowing the password doesn't help, meaning you have to break AES to get to the disk (which is not happening realistically). ---------------------------------------------------------------------- Fungled · 2023-12-10 12:24 Same. Blind type the password, but added some pc speaker beeps to the boot process to make that easier (before and on drives starting to mount). Works really well and secure af ---------------------------------------------------------------------- cspotme2 · 2023-12-10 12:36 My bitlocker vms auto-unlock my Linux vms using luks and dropbear. ---------------------------------------------------------------------- lilolalu · 2023-12-10 12:43 Check out clevis/tang https://bbs.archlinux.org/viewtopic.php?id=288568 ---------------------------------------------------------------------- jflatz · 2023-12-10 12:52 ZFS Native Encrypted dataset that gets decrypted on boot with a key stored in TPM. ---------------------------------------------------------------------- EnricoSuavePallazzo · 2023-12-10 13:22 No. Reading a lot of the comments, many of you live in apartments or some other close quarters, and I can understand having a concern over physical security of your equipment. I live in a single family home on a bigger lot in a very low property crime area. Having my servers and/or drives stolen is basically a zero probability for me. With that said, I'd like to turn it around on some of you -- \*if\* you were very comfortable with the physical security of your devices, would you still encrypt it? ---------------------------------------------------------------------- stringfellow-hawke · 2023-12-10 13:28 I’m struggling to envision someone breaking into my home, finding the absolute boat anchor that’s my storage array and saying, “Yes. That.” lol. I’m very much in favor of device encryption, but it seems an extreme threat vector for servers that’s not worth the mitigations. Now if your rig isn’t installed in a rack and/or portable enough to be a smash and grab, then that’s different. But that sounds like a good excuse to build out your install. :) ---------------------------------------------------------------------- morbidpete84 · 2023-12-10 13:33 LUKS on all my nix servers and bitlocker on my win machines. Use a pikvm with another KVM to switch between the machines when not at home and need to reboot ---------------------------------------------------------------------- jflatz · 2023-12-10 13:35 Yes, because eventually the hard drives will be decommissioned or otherwise not in my possession and I don’t want spillage ---------------------------------------------------------------------- jflatz · 2023-12-10 13:36 Until you need to RMA or retire the disk… ---------------------------------------------------------------------- gargravarr2112 · 2023-12-10 13:42 RMA - generally my under-warranty drives are part of a RAID-Z2. If they can reconstruct it from a single disk, I'll be impressed. Retire - I physically destroy disks that have personal data on them (drilling holes right through the platters). So even if they're not capable of being DBAN'd, I'm not worried. You are correct though, encrypting the drives does make this less hassle. But I CBA with decrypting the drives every time I reboot the machine. ---------------------------------------------------------------------- Beastmind · 2023-12-10 13:47 No. The importants files that could have my personals details are on a veracrypt file, the rest doesn't need to be bullet proof ---------------------------------------------------------------------- j0hnp0s · 2023-12-10 13:48 I usually have a small LUKS partition for my sensitive documents. I don't unlock it automatically since I don't need the docs often. ---------------------------------------------------------------------- peterge98 · 2023-12-10 13:48 Nope. I have physical access control ---------------------------------------------------------------------- Martin8412 · 2023-12-10 14:03 If you don't trust enhanced secure erase built in to most modern SSD/NVMe it indeed makes it much quicker to wipe the drive. Just overwrite the first 20MB or so of the partition with 0s some times, and any hope of recovering data dwindles to zero. ---------------------------------------------------------------------- unistirin · 2023-12-10 14:08 You can create a luks partition without header information written to the disk. What i did is, while creating the Luks partition, I moved LUKS headers to somewhere else. Whenever i want to decrypt the disk now, I need a header plus the password of it. Without both, i cnt decrypt the disk. You can store headers in Vault or some other Secrets managers. ---------------------------------------------------------------------- unistirin · 2023-12-10 14:19 You can create a luks partition without header information written to the disk. You can store this header info somewhere else. Now to decrypt the disk you need both a header + password. ---------------------------------------------------------------------- ApplicationException · 2023-12-10 14:47 Maybe I'm misunderstanding how it works, but does the auto unlock rely on a pi on your network so stealing the server and trying to boot it off network wouldn't trigger the auto unlock? ---------------------------------------------------------------------- Simon-RedditAccount · 2023-12-10 14:47 For CMR HDDs, this work. For SSDs with overprovisioning, not so much (depending on your threat model, of course). There's a small chance that your header still will be available. Solution: either use strong password (60bits of entropy at least) + modern KDF (Argon2id), or use a keyfile on an external drive. Or **f**TPM. Again, depends on your threat model: for RMA or ordinary thieves this is an overkill. For a criminal tech-savvy gang that knows that you keep something really valuable there - not so much. ---------------------------------------------------------------------- Mintfresh22 · 2023-12-10 14:48 No ---------------------------------------------------------------------- andvell · 2023-12-10 15:11 Encrypted volumes for sensitive stuff with Veracrypt, no automount. ---------------------------------------------------------------------- NekoLuka · 2023-12-10 15:22 No, but I'm also still in the process of building out my storage solution. But even so, I would only encrypt things such as my password vault. But I live in a safe location, and not really scared of a breakin... Fires are more of a concern for me ---------------------------------------------------------------------- DarkChen · 2023-12-10 15:22 my server is just the start of a plex server and a learning environment. Its already old and dated with a bunch of repurposed parts so the way i see it, encryption would just put additional unnecessary stress on it... ---------------------------------------------------------------------- emprahsFury · 2023-12-10 15:28 Thats probably the hardest way to set up auto unlock. Most disk auto unlock schemes just move the security to the OS logon screen so if they steal the whole computer you're dependent on the logon screen. ---------------------------------------------------------------------- Martin8412 · 2023-12-10 15:32 I use a password with more than 100 bits of entropy, but I stick with defaults for LUKS on Arch Linux. I don't remember what KDF they use. Then again, my threat model is just random break-ins. I don't ever throw away drives. I might give them away for free to people with no IT skills who need a computer. ---------------------------------------------------------------------- emprahsFury · 2023-12-10 15:32 It might defeat your extended purpose, but the hdds are still encrypted. And if the hdds are stolen the data on them wont be usable. Let the hdd encryption scheme simply protect the hdds. ---------------------------------------------------------------------- d4nowar · 2023-12-10 15:38 I encrypt them with a physical lock on the door. ---------------------------------------------------------------------- ericesev · 2023-12-10 15:43 Same here. ZFS send/receive works great for backing up the encrypted volumes too. ---------------------------------------------------------------------- zcapr17 · 2023-12-10 15:44 Good to know. My Synology is 10 years old so doesn't support the KMIP method. ---------------------------------------------------------------------- tobimai · 2023-12-10 15:55 No. Don't really see the benefit. If someone breaks in they get valuables and cash, tech just looses value too fast and is hard to resale. Also Break-ins don't really exists in apartments, houses are more likely if you leave the door open etc. ---------------------------------------------------------------------- Scaredy14 · 2023-12-10 15:56 I've never heard of LUKS, so I have a quick question for you. While your server is running and the drives are decrypted, if someone steals your computer by just pulling the power cable, does your server not have a chance to encrypt again before shutdown? Or am I misunderstanding a fundamental part of how it works? Are the drives always encrypted, and decryption happens live during reads? ---------------------------------------------------------------------- Simplixt · 2023-12-10 15:56 My 218+ is also not official supported, but I could edit the "/etc.defaults/synoinfo.conf" and set "support\_volume\_kmip=yes" "support\_volume\_encryption=yes" But with a 10 year old Synology I'm not sure. As KMIP Server I used this one [https://github.com/rnurgaliyev/kmip-server- dsm](https://github.com/rnurgaliyev/kmip-server-dsm) ---------------------------------------------------------------------- coffinspacexdragon · 2023-12-10 16:29 There is no good reason not to encrypt. ---------------------------------------------------------------------- IceOleg · 2023-12-10 16:43 That is way past my threat model, at least when it comes to the home server. Its a good technique to keep in mind, and I do sometimes consider using this setup for mobile devices. ---------------------------------------------------------------------- IceOleg · 2023-12-10 16:47 > Or am I misunderstanding a fundamental part of how it works? Are the drives always encrypted, and decryption happens live during reads? Exactly this. There is never anything decrypted written to the drive. The drives aren't "decrypted" when the server is running so to speak. Its more so that the kernel has the encryption key available to decrypt any content it needs to read, and to encrypt any content that it needs to write.. ---------------------------------------------------------------------- Scaredy14 · 2023-12-10 16:51 Thanks! That makes a lot of sense! ---------------------------------------------------------------------- Sekhen · 2023-12-10 16:51 Ain't nobody got time for that... ---------------------------------------------------------------------- IceOleg · 2023-12-10 16:54 > With that said, I'd like to turn it around on some of you -- *if* you were very comfortable with the physical security of your devices, would you still encrypt it? Absolutely, yeah. ---------------------------------------------------------------------- CambodianJerk · 2023-12-10 17:33 Sounds decent. Any particular guides you're aware of? ---------------------------------------------------------------------- DIBSSB · 2023-12-10 17:50 No performance is slower ---------------------------------------------------------------------- FrontDry1622 · 2023-12-10 17:59 This guide should cover everything needed to get started https://www.cyberciti.biz/security/how-to-unlock-luks-using-dropbear- ssh-keys-remotely-in-linux/ ---------------------------------------------------------------------- CambodianJerk · 2023-12-10 18:09 Thanks very much! ---------------------------------------------------------------------- ApplicationJunior832 · 2023-12-10 18:13 Only the OS drive and my personal backup drives (docs, photos, etc). The other stuff, nah, no point ---------------------------------------------------------------------- scytob · 2023-12-10 18:14 No. Because if they broke in they already have SSN and passport and I don’t use illegal porn on my servers. ---------------------------------------------------------------------- dash199t · 2023-12-10 18:18 If your system is Not older than a year, it is argon2id ---------------------------------------------------------------------- bobbarker4444 · 2023-12-10 18:35 What kind of sensitive data are people storing on their home servers that genuinely requires drive encryption? ---------------------------------------------------------------------- tanjera · 2023-12-10 18:44 A little confused on this setup- can you explain where dropbear SSH is installed so that it holds the terminal on boot for the password entry? My understanding is that on boot, a KVM like iDRAC would be needed, but I'm ready to learn if that's not true! ---------------------------------------------------------------------- Simplixt · 2023-12-10 18:54 You use initramfs to hook the Dropbear ssh server into the boot process, so you can do cryptroot-unlock via SSH on boot. ---------------------------------------------------------------------- Adesfire · 2023-12-10 19:28 Encryption exists, thus should be used. Like HTTPS. ---------------------------------------------------------------------- primevaldark · 2023-12-10 19:33 Partially. Important documents, scans, banking statements etc are stored under eCryptfs and Encfs. Photos etc are stored directly. ---------------------------------------------------------------------- adamshand · 2023-12-10 19:50 No. I lost of volume worth of data to a bug (or possibly user error) in encryption software many years ago. I've been a bit gun shy about full disk encryption since. Which is more likely losing encrypted data due to a bug/mistake or having my hardware stolen? Not sure, both are pretty unlikely ... so I do the easiest thing, which is not to encrypt. ---------------------------------------------------------------------- tanjera · 2023-12-10 20:43 That's really cool, thanks for making that connection for me. For anyone else curious and for my future self rummaging through old comments to find this solution when I'm ready to implement, Debian package dropbear-initramfs streamlines installing dropbear sshd, configuring, and loading into the initramfs- then login via ssh, run unlock script, boot proceeds and presumably kills the dropbear sshd and continues boot. ---------------------------------------------------------------------- bbyboi · 2023-12-10 21:10 Yes. I don't want anyone stealing it to get access to my data. On my Synology I put all data on encrypted mounted volumes. ---------------------------------------------------------------------- frisky_5 · 2023-12-10 21:12 ZFS encryption and i type my password on boot with dropbear in case i reboot remotely ---------------------------------------------------------------------- nodejsdev · 2023-12-10 21:17 I am trying this on my 218+ and enabling KMIP is missing. Do you have any suggestions? ​ https://kb.synology.com/en- br/DSM/help/DSM/AdminCenter/connection\_security\_kmip?version=7 ---------------------------------------------------------------------- natermer · 2023-12-10 21:46 Nope. People stealing harddrives is much less of a threat to my data then hardware/software failure and encryption makes it much more difficult to recover the data. I'll encrypt stuff that stays offline most of the time, though. Also backups to the cloud, etc. The important stuff I want to keep secret is encrypted by default and is copied to multiple places. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-12-10 21:59 Most auto-unlock methods rely on TPM chip. It analyzes your PCR registers, including present hardware and hashes of the bootloader. If everything is OK, it unseals the key and the bootloader uses it to decrypt the drive. If any new hardware is present or bootloader hash differs, the key remain locked. Then you should investigate the issue and/or enter (another) key manually. Depending on how motivated your adversaries are, you may be interested in using a fTPM, and not dTPM (because many of the latter can be manipulated by skilled folks in an electronics lab - as many dTPMs just use a simple SPI bus for communication). ---------------------------------------------------------------------- RagnarLind · 2023-12-10 22:00 Yes, it is standard operating procedure. There is no 100% guaranteed physical security. Encryption does not slow down a modern drive so there is no need not to encrypt. ---------------------------------------------------------------------- esturniolo · 2023-12-10 22:01 Si, if I understand correctly, you use your Pi like some kind of YubiKey? ---------------------------------------------------------------------- RagnarLind · 2023-12-10 22:08 Yes, Windows with Veracrypt. Im a trans linux and will also encrypt them machines with something, likely LUKS. Because if the discs get stolen. Also have advanced account passwords, bios boot passwords and have a classification of my machines on what kind of data are allowed on them. ---------------------------------------------------------------------- ZaxLofful · 2023-12-10 22:13 Thanks for the idea! Had most of this in my mind already, but had a few missing links. :) ---------------------------------------------------------------------- malachi347 · 2023-12-10 22:54 This thread has really gotten me to consider encryption. Heretofore, I've just been focused on netsec and never even considered measures in place should the equipment be physically lifted, heh. Speaking from experience and what I know about criminals in my area, they may have the balls to commit crime, but they don't have nearly enough brains to circumvent even the most basic security policies. I feel like encrypting ALL my data would be extreme overkill. Do you just encrypt specific folders? ---------------------------------------------------------------------- EngineerRedditor · 2023-12-10 22:54 I did not know [Dropbear SSH](https://youtu.be/7TLPExkUHqw?feature=shared), thanks a lot for mentioning it 🤩 ---------------------------------------------------------------------- ItalyPaleAle · 2023-12-10 23:18 I use ZFS so native ZFS-on-Linux encryption. For unlock, I use this app I wrote: [Revaulter](https://github.com/italypaleale/revaulter). The keys are stored locally but wrapped (ie “encrypted”) with a key stored on Azure Key Vault. When the server boots up it sends me a notification to sign in (using my Azure AD account, with MFA) and approve the request to unwrap (ie “decrypt”) which unlocks the disks. The raw key material is never stored un-encrypted anywhere and the server does not have standing access to unwrap the keys, it does require me to sign in and approve the request. (Legally-mandated disclaimer: I work for Microsoft, but this project was built on my spare time and it’s not supported or endorsed by my employer) ---------------------------------------------------------------------- EpiJunkie · 2023-12-10 23:27 This is the way. ---------------------------------------------------------------------- Simplixt · 2023-12-10 23:32 Ah sorry, somehow copied the variable wrong into my documentation. Great it works now! I just hoping the unlocking of KMIP/Volume-Encryption for 218+ will not break with a future version update of Synology. But for now it's working really great :) ---------------------------------------------------------------------- chrishas35 · 2023-12-10 23:53 Using the static password of the Yubikey, or is there something better? ---------------------------------------------------------------------- SheriffRat · 2023-12-11 00:24 Do you have backup of your NAS data somewhere else as well? I've encrypted my NAS, but if something happens to it, that would be all my data gone ---------------------------------------------------------------------- zcapr17 · 2023-12-11 00:26 Why do you think encrypting all data would be overkill? On today’s hardware LUKS or Bitlocker have minimal performance impact and can be configured as part of the OS install. Managing encryption at folder level is more hassle than it’s worth in my opinion. ---------------------------------------------------------------------- _Old_Greg · 2023-12-11 00:33 No, the whole drives. ---------------------------------------------------------------------- KrokettenMan · 2023-12-11 00:33 No, because it’s very unlike that of my home was broken into they’d take all the effort to take disks out of a server when there are much more valuable things. For disposal I just drill through the platters. Disk encryption is a data loss risk I’m not willing to take ---------------------------------------------------------------------- malachi347 · 2023-12-11 02:32 I'm sure you're right! That's why I said this thread has opened my eyes a bit. The last time I even considered encryption was literally over a decade ago, and it definitely had massive performance complications. ---------------------------------------------------------------------- 8484215 · 2023-12-11 04:39 Effectively, yes. Unraid out of the box allows for a keyfile to be automatically used to decrypt array drives, the pi is just a cheap, easy way to provide the file at boot. ---------------------------------------------------------------------- usrdef · 2023-12-11 06:23 I don't use the Static password feature. I use challenge response as my button action. Static password may be useful, but it's also a hole in security. If you insist on using a static password; then I would use a STRONG password, and only put half on the Yubikey as a static. Then you have to manually type in the other half. For my encryption, I use generated GPG keys that I've placed on the Yubikey, and the Yubikey has to be inserted and the PIN provided for me to decrypt. ---------------------------------------------------------------------- bevdberg · 2023-12-11 07:10 I’m a complete noob at cyber security, but doesn’t this increase attack surface? Now you to worry about the pi, the connection to unraid and unraid itself? ---------------------------------------------------------------------- 8484215 · 2023-12-11 07:18 Not really. By securing the pi to only allow connection via SSH from the server, if we trust SSH then a remote attack of my server needs to happen first for the pi to be a target, but at that point it's not a target since the decrypted server is already compromised. If SSH can be compromised, then the decrypted server can be equally attacked directly, pi is a useless target. So for the attack vector being a remote attack against the running server, the pi makes that surface no worse. What the pi does do is add security for a totally different attack vector that I want mitigated - that being my hardware being stolen and thereby power removed. Now I'm defending my data at rest. ---------------------------------------------------------------------- Hannigan174 · 2023-12-11 07:18 I am also someone who never bothered to encrypt home-server drives... however, I don't have anything on these drives that needs encryption. The simplicity of having anyone just turn something on with a press of a button and/or when it boots from a power failure just to work is too great of a convenince for me to encrypt home-assistant, adguard, and various other files. I do have encrypted storage for things that I feel need it (SSN containing stuff, etc.), but it seems like encrypting server OS drives is unneccessary for most of my uses. Basically it seems like this is something that a lot of people are doing by default as it is "best practice" even if their particular case it is not particularly useful. If I am missing something and it is more generally useful I'd like to get that opinion, but simply having home assistant work after a power outage is a LOT more useful to me than preventing someone who steals my home server boxes from being able to run it ---------------------------------------------------------------------- chrishas35 · 2023-12-11 14:13 I did not realize you could do challenge response for this. Nor the key storage. Very interesting. Do you have any source documentation that was helpful to you? Can you have two keys enrolled (or have the same keys on two), so a backup can be kept safe? Wheels are spinning now... ---------------------------------------------------------------------- AnalProlapseForYou · 2023-12-11 18:29 Yes. I use a combination of LUKS and Shufflecake on everything, with two yubikeys for the decryption. One is on my person at all times, and the other I keep in a safe deposit box at my bank. ---------------------------------------------------------------------- usrdef · 2023-12-11 20:48 [https://docs.yubikey.wiki/](https://docs.yubikey.wiki/) Plenty of tutorials and info on there. Enrolled as in what? A challenge response? You can add the same challenge response to as many keys as you want. If you're talking FIDO, you have to manually insert each Yubikey into your machine, and add it to the website. For GPG, PIV, if you generated the keys OFF the Yubikey, all you have to do is plugin the 2nd Yubikey in, and import your GPG / PIV keys. If you generated your GPG keys or PIV cert on the Yubikey itself, no. They cannot be imported onto another Yubikey. ---------------------------------------------------------------------- Awkward-Class-7230 · 2023-12-11 22:17 Luks & Unlocking via SSH https://nixos.wiki/wiki/Remote\_LUKS\_Unlocking ---------------------------------------------------------------------- Hybridtheory28 · 2023-12-11 22:57 That's what I figure too. I don't think the local crackheads really care what's on your hard drive. ---------------------------------------------------------------------- rayjaymor85 · 2023-12-12 12:52 As far as I am aware (and if I am wrong then feel free to correct me) but once the drives are unlocked the data is freely accessible. If someone has stolen my server, they'll have unfettered access to it for a substantial period of time. I would say it's not impossible to brute force my root password in a few days. A month or so if I am lucky. That password is really only designed to stop my kid from f\*\*\*ing around when he gets curious. Now, my LUKS passphrase is a very different matter entirely. But if that passphrase is in a keyfile protected only by my root password, or a USB drive that I'll almost certainly forget to pull out - then my LUKS passphrase may as well be "Password123" ---------------------------------------------------------------------- kmisterk · 2023-12-12 16:16 ## Post Removed Hey, Simon-RedditAccount! Thanks for your submission on selfhosted. Your post has been removed due to a violation of the purpose of the subreddit: **Self Hosting** ## Not Self-Hosted When it comes to posts regarding applications in this subreddit, they must feature a self-hosted tool, or a tool that *can be* self-hosted, or some kind of related information, help request, or otherwise related to a tool that is something that one can self-host. If you believe this post *is in fact* relevant to /r/selfhosted, feel free to [message the mods](https://www.reddit.com/message/compose/?to= /r/selfhosted&subject=Removed For Not Being Self- Hosted&message=[Removed Post](https://www.reddit.com/r/selfhosted/comments/18f0fuz/-/\)) with your concerns.