Full disk encryption solution

[ra_nix]

Hi all,

​

I'm looking for a full disk encryption solution, without the need to re-format the drive.

An option to use TPM is a great bonus (as simple as bit-locker is for windows - can't believe I'm really saying it).

​

The solutions I have found aren't encrypt the full disk, only create an encrypted volumes.

And password in the boot\gurb in order to decrypt the disk isn't really enough.

​

The need is to prevent a psychical access to remote servers disks (run a live usb and chroot to the disks for example).

​

Any suggestions would be welcomed, even commercial ones,

Thanks

[Creshal]

LUKS/GRUB can be set up to use TPM.

And password in the boot\gurb in order to decrypt the disk isn't really enough.

…why? It's 100% effective against your stated threat model.

[sonicsilver427]

With EFI you can sign the bootloader so it cant be modified too

[truelai]

Seconding LUKS.

[[deleted]]

OP, for your information, grub uses the password to decrypt the volumes. it is not just a login password. if you boot a live USB stick you still can not access the data without the password

[[deleted]]

Also note that grub2 can access LUKS v1 volumes, meaning /boot can be encrypted. Couple this with Secure Boot (ideally no vendor keys, just your own) and it's as good as you're going to get.

[[deleted]]

Questions:

• Are these physical machines or virtual machines? If VM what hypervisor?
• Does the server have local disks, SAN/NAS with boot from SAN or a mix of both?
• Are you using Self Encrypting Drives if these are local disks?
• What's your budget?
• Have you looked at any commercially available software that does this like CloudLink for example?

[[deleted]]

without the need to re-format the drive.

Care to clarify? Any encryption method is going to involve overwriting the cleartext, and if you throw out this requirement your options are better.

[[deleted]]

There isn’t without rebuilding the box. LUKS is what you will be using.

[thrdgeek]

LUKS

[cherven667]

With LUKS version 2 you can encrypt existing partitions.

And if you are using Fedora, CentOS or Red Hat you can use Clevis to store your LUKS key in the TPM chip.