Encrypt user data at rest #129

New Issue

raucao · 2020-02-06T21:40:07Z

raucao commented

2020-02-06 21:40:07 +00:00

First thing that comes to mind is the ejabberd database, which contains lots of metadata, even if the contents of personal communications are encrypted.

Sovereign uses EncFS for this, and I think that's actually a pretty good idea. Also supposedly faster with HDDs (which we use on Andromeda for example).

https://github.com/vgough/encfs

First thing that comes to mind is the ejabberd database, which contains lots of metadata, even if the contents of personal communications are encrypted. Sovereign uses EncFS for this, and I think that's actually a pretty good idea. Also supposedly faster with HDDs (which we use on Andromeda for example). https://github.com/vgough/encfs

greg commented

2020-02-07 10:31:22 +00:00

Good idea. We might want to compare it with eCryptfs and other solutions

Good idea. We might want to compare it with [eCryptfs](https://help.ubuntu.com/lts/serverguide/ecryptfs.html) and other solutions

raucao commented

2020-02-07 15:23:47 +00:00

Regarding ecryptfs, that's what I meant with faster on HDDs, but didn't explain in detail:

https://github.com/vgough/encfs#fast-on-classical-hdds

Regarding ecryptfs, that's what I meant with faster on HDDs, but didn't explain in detail: https://github.com/vgough/encfs#fast-on-classical-hdds

greg referenced this issue from a commit

2020-05-15 16:43:46 +00:00

Encrypt the Postgresql data dir on the replica (centaurus) encfs always runs a configuration assistant when creating a new volume, so this needs to be done manually: systemctl stop postgresql@12-main mv /var/lib/postgresql /var/lib/postgresql.old encfs /var/lib/postgresql_encrypted /var/lib/postgresql --public Pick p (paranoia mode) and enter the password from the data bag twice mv /var/lib/postgresql/* /var/lib/postgresql/ systemctl start postgresql@12-main This is running on centaurus and is mounted automatically on boot by a system unit Refs #129

greg referenced this issue

2020-05-15 16:48:45 +00:00

Encrypt PostgreSQL data directory #166

raucao added a new dependency 2020-06-04 10:50:40 +00:00

#175 Replace andromeda.kosmos.org

raucao commented

2020-08-02 18:09:45 +00:00

Closing this issue now. We have implemented a cookbook for this, which is already being used on the new servers. And every service we migrate to one of the new machines (which will be all of them soon) will use encrypted directories for all user data.

raucao closed this issue

2020-08-02 18:09:46 +00:00

Sign in to join this conversation.

No Milestone

No project

No Assignees

2 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Blocks

#175 Replace andromeda.kosmos.org

kosmos/chef

Reference: kosmos/chef#129