Arch Linux

arch_fuz

Member

Registered: 2015-01-31

Posts: 53

LUKS / LVM | Security

Hi.
I am sharing a Virtual Machine with someone and I would like to make sure the my data belongs to me

My plan is to use VM with a LUKS-encrypted partition including my personal data (mail server in this case) and have it set up using LVM. The VM host is using LVM also.
Do you see any security concern with this approach?

I read this article also
https://wiki.archlinux.org/title/Removi … encryption

Is there anything I am not aware off, i.e. is the password for LUKS stored in memory somewhere or are there other issues?

Thanks for your help.
_fuz

Slithery

Administrator

From: Norfolk, UK

Registered: 2013-12-01

Posts: 5,776

Re: LUKS / LVM | Security

If it's a mail server doesn't your data have to be permanently unlocked for it to function properly?

---

No, it didn't "fix" anything. It just shifted the brokeness one space to the right. - jasonwryan
Closing -- for deletion; Banning -- for muppetry. - jasonwryan

aur - dotfiles

arch_fuz

Member

Registered: 2015-01-31

Posts: 53

Re: LUKS / LVM | Security

Yes, it must be completely be unlocked for operations.
I am more concerned about internal security than external. I do not want someone to copy the image of my virtual machine an get it working on a different vm host.

frostschutz

Member

Registered: 2013-11-15

Posts: 1,648

Re: LUKS / LVM | Security

LUKS basically only provides at-rest encryption. If someone else has access to the VM host, they can dump memory, and grab keys.

Even so I also encrypt my VPS simply because I have no control over what happens with the hard drives after failure. Plus there is the human/configuration error component, like another VM might run with access to my drive, also without my knowledge. Things like that.

So if you need encryption it might be better than nothing, just don't expect it to be secure against a determined person who you already know has access to the system because you're sharing them. Essentially you should only share if you have a very high level of trust.

Slithery

Administrator

From: Norfolk, UK

Registered: 2013-12-01

Posts: 5,776

Re: LUKS / LVM | Security

So you're not sharing the VM then, you're sharing the host?

---

No, it didn't "fix" anything. It just shifted the brokeness one space to the right. - jasonwryan
Closing -- for deletion; Banning -- for muppetry. - jasonwryan

aur - dotfiles

arch_fuz

Member

Registered: 2015-01-31

Posts: 53

Re: LUKS / LVM | Security

@frostschutz
It is definitivly not what I would have liked to hear but I am afraid you are right. As with todays high energy prices I would have tried to avoid running another host...

@Slithery
Right, not sharing VM, sharing VM host instead.

Thanks to both of you for your help

arch_fuz

Member

Registered: 2015-01-31

Posts: 53

Re: LUKS / LVM | Security

@frostschutz
I like your nick - it is cool in any sense