How would you protect files of a VPS (Virtual Private Server) from snooping by the service provider?

  • ouch@lemmy.worldOP
    0·
    2 months ago

    Thanks for the comments. I agree on the general consensus, that once an encryption key enters the VPS, the encryption is compromised.

    However, I’m thinking more in practical terms, eg. the service provider doing just casual scanning across all disks of VPS instances. Some examples could be: cloud authentication keys, torrc files, specific installed software, SSH private keys, TLS certificates.

    • Lemmchen@feddit.orgEnglish
      0·
      2 months ago

      Modern CPUs have some RAM encryption features, but ultimately you’re running on hardware outside your control. Personally, I use full disk encryption (except for /boot) and unlock remotely via SSH, but that only helps against automatic scanning of the storage.

      • ouch@lemmy.worldOP
        0·
        2 months ago

        Do you use dropbear and manually input the password to unlock the LUKS partition, or have you scripted something to automate that?

        • Quail4789@lemmy.mlEnglish
          0·
          2 months ago

          I mean, assuming you’re telling the truth about there being a competent group seriously attempting this, it’s still “trust us bro” to conclusively claim it can’t be achieved without providing a shred of evidence. This makes your original comment irrelevant and worthless.

  • schizo@forum.uncomfortable.businessEnglish
    0·
    2 months ago

    Depends on your threat model and actual realistic concerns.

    Ultimately, if it comes down to it, there’s very little you can do that’s failsafe and 100% guaranteed: the provider has access to your disk, all data in your instances RAM (including encryption keys), and can watch your processes execute in real time and see even the specific instructions your vCPU is executing.

    Don’t put illegal shit on hardware you do not physically own and have physical control over, and encrypt everything else but like, if the value of your shit is high enough, you’re fucked if you’re using someone else’s computer.