Current state of support for OS disk encryption in OMV

1st Official Post

    I am trying out OMV 6 (current version is 6.0.24 at time of writing this). I searched for information about disk encryption in OMV, but I mostly found explanations and questions about encrypting storage volumes. When it comes to encrypting the OS volume, that is, the HDD/SSD that contains the OMV rootfs, I only found: https://github.com/gandalfb/op…ault-full-disk-encryption - and these steps seem rather elaborate, the outcome uncertain (see the notes about Docker mount errors that can happen if OS disk encryption is done differently for example). I see a risk of instability and (potentially silent) errors here that I am unwilling to take for a NAS machine that runs 24/7 and houses my data.


    Therefore, it seems to me that at this stage, encrypting the OS volume is simply not possible in OMV without spending considerable amount of time studying the inner workings of OMV to ensure that any manual attempts at accomplishing this task do not exhibit unwanted side effects.


    But this is then a pity, since encrypting the OS disk has the nice advantage that any risk of information leakage (log files stored in a non-volatile mount point for example) is dealt with - all of the data is encrypted (or resides in volatile storage). Without encryption, it becomes necessary to check each and every service, daemon etc. for what files it creates and where these are stored.


    Thoughts? Opinions? Experiences?

  • chente

    Approved the thread.

    in my oppinion have no sense to encrypt OS disk, because a NAS are intended to run 24/7 so always you see it unencryted and accesible, other case is to encrypt data volumes, that have sense if you can in a easy way mount/unencrytp and later unmount to maintain data encrytpted.


    For this escenario I use Veracrypt in windows ( I simple store encrytpted volumen in the NAS) and mount/unencrytp on Windws when needed.

    I really don't understand why you (anyone) would want this.


    Encryption only makes sense against physical theft and for personal/sensible data.

    That DATA should never live on an OS drive.


    To run the OS, the drive need to be unlocked at boot time, so ALL files are "open" .

    Any "leakage" will show them unencrypted.


    If you're concerned about logs beeing seen, just make sure that your server is properly protected so noone can hack it, even though, there's no such thing as an unbreakeable Server/OS.

    For a personal home NAS, I think the main gain of encryption is that in case of theft, your data is safe (well, you better have an off site backup - can be as simple as an external HDD). Stealing the machine means powering it off, so the drives don't remain locked. This advantage is compromised if for example the LUKS header is cached in a non volatile location on the OS rootfs. Hence my concerns.

    • Official Post
    Quote from meox1x9

    For a personal home NAS, I think the main gain of encryption is that in case of theft, your data is safe (well, you better have an off site backup - can be as simple as an external HDD). Stealing the machine means powering it off, so the drives don't remain locked. This advantage is compromised if for example the LUKS header is cached in a non volatile location on the OS rootfs. Hence my concerns.

    While I can somewhat agree w/ this.... You think guys who can do anything more than look at a computer can look and say, "Yeah I can pawn that for 20 bucks to get some meth" would have any idea what they were doing to get your data. Most people would turn it on, and not see a GUI, and assume it was broken. Let's not even get into trying to google how to reset the root password, etc.

    • Official Post
    Quote from Soma

    If you're concerned about logs beeing seen, just make sure that your server is properly protected so noone can hack it, even though, there's no such thing as an unbreakeable Server/OS.

    From what I read in a post a long time ago, gderf has its server physically located inside a safe. Attached to the inside of the door.

    Quote from chente

    From what I read in a post a long time ago, gderf has its server physically located inside a safe. Attached to the inside of the door.

    I meant software hack, 😉


    But to prevent theft, that can work well, 😁

    Better yet, if you rig a 400V electric fence around it, 🤣

    Quote from chente

    From what I read in a post a long time ago, gderf has its server physically located inside a safe. Attached to the inside of the door.

    Yes, I have it hanging on the door of my safe. A side benefit of this is that the temperature inside is kept warm and the humidity low.

    --
    Google is your friend and Bob's your uncle!


    A backup strategy is worthless unless you have a verified to work by testing restore strategy.


    OMV AMD64 7.x on headless Chenbro NR12000 1U Intel Xeon CPU E3-1230 V2 @ 3.30GHz 32GB ECC RAM.

    OMV AMD64 8.x on headless Tyan SX GT86C-B5630 1U Server with Intel Xeon Silver 4110 CPU @ 2.10GHz & 32GB DDR4 ECC RAM.

    Like 3 Haha 1
    • Official Post
    Quote from gderf

    Yes, I have it hanging on the door of my safe. A side benefit of this is that the temperature inside is kept warm and the humidity low.

    LOL, that is just awesome. I'm coming up with a whole new idea for the gun safe I'm about to get. Even for the monster chassis I have now, the safe I want I could make room in there for it (won't hang on the door like yours, but I can make the modular shelving system work)

    Mine is 1U and barely clears the shelving when the door is closed. Only thing that is different from the picture is the cables - one power and two ethernet. I wish there were more of these available. At the price I paid I would gladly buy another just to have as a spare.

    --
    Google is your friend and Bob's your uncle!


    A backup strategy is worthless unless you have a verified to work by testing restore strategy.


    OMV AMD64 7.x on headless Chenbro NR12000 1U Intel Xeon CPU E3-1230 V2 @ 3.30GHz 32GB ECC RAM.

    OMV AMD64 8.x on headless Tyan SX GT86C-B5630 1U Server with Intel Xeon Silver 4110 CPU @ 2.10GHz & 32GB DDR4 ECC RAM.

    Like 1

    I have been running several NAS with fully encrpyted root, home and swap partitions for some years now.

    Also the RAID that contains the actual data of the NAS is fully encrypted.


    I run this setup for reasons already mentioned in this thread:

    - physical theft of the machine

    - I do store the keyfile for the RAID on the root fs (so that the RAID can be unlocked during boot via /etc/crypttab automatically)

    -> so I do not want this keyfile to sit around in an unencrypted root fs (when the machine is off)


    I did create my own little step-by-step guide on how to do this.

    And this guide was working for years on different OMV versions, but unfortunately it now fails in OMV6 (some problem during update-initramfs which leads to cryptsetup not being included in the boot image -> unbootable machine after the installation of OMV).


    If somebody is interested in the stept-by-step I could post it here.

    Maybe somebody would then be able to help resolve the issue in OMV6...

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!

Register Yourself Login