this post was submitted on 18 Jun 2025
45 points (92.5% liked)

Selfhosted

60024 readers
934 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam.

  3. Posts here are to be centered around self-hosting. Please ensure it is clear in your post how it relates to self-hosting.

  4. Don't duplicate the full text of your blog or git here. Just post the link for folks to click.

  5. Submission headline should match the article title.

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
45
Encrypting without full disk encryption question (piefed.ca)
submitted 1 year ago* (last edited 1 year ago) by teppa@piefed.ca to c/selfhosted@lemmy.world
23 comments fedilink hide all child comments
 

I use a headless server connected to nothing but an ethernet cable in my basement, and I'd prefer to allow the thing to boot by itself and start up without me needing to unlock the disk encryption every single time I do an update or power back on. Its a Dell 9500t NUC that I'm using it as a server and am wondering whether its possible to encrypt everything still.

I do generally use docker containers, so could I potentially encrypt just the containers themselves, assuming I'm worried about a smash and grab rather than someone keeping the machine powered up and reading my ram?

you are viewing a single comment's thread
view the rest of the comments
[–] partial_accumen@lemmy.world 22 points 1 year ago (2 children)

assuming I’m worried about a smash and grab

For your specific use case, how about this:

Get a cheap USB thumb drive and a long USB cable. Put your disk unlock password on that thumb drive, and semi-permanently affix the USB drive to your building. You said you're in a basement. Put it on top of a rafter with a metal fitting that would keep the drive from being taken without removing the screws. Run the long USB cable from the thumb driving in your rafter to the USB port on the machine. Alter your startup script to mount the thumb drive read the password from the thumb drive to unlock your main disk. Don't forget to immediately unmount the thumbdrive in the OS after the disk is unlocked for extra safety.

If someone is doing a smash and grab, they'll unplug all the cables (including this USB cable going to the thumb drive) and take your machine leaving the disk encryption password behind on the USB thumb drive.

[–] Shimitar@downonthestreet.eu 7 points 1 year ago (1 children)

This is a good idea. Use an cat5 USB extender for maximum range (100mt) and put the USB drive even further away.

[–] Onomatopoeia@lemmy.cafe 2 points 1 year ago

Plus it just seems like a network cable. A bit of security obscurity.

[–] JustEnoughDucks@feddit.nl 1 points 1 year ago

This is similar to what I do.

I have a USB drive with the whole bootloader + decryption keyfiles on it. I remove it while it is running as everything is stored in RAM and already booted.

Downside being it has to be plugged in to update the boot partition during an upgrade.