Encrypting Proxmox OS disk - Encrypting data at rest

[been2siliconvalley]

Hi! Congratulations on the release VE 6.2!


How can I install this with encryption for data at rest for the OS disk?
This is important because my private cloud is not as securely physically stored as it should be.
Any better and more secure solutions is outside of my budget, such as a dedicated hosting location with physical security guards.
Therefore I seek to encrypt data at rest for all data storage containers, including the OS disk.

 

[wolfgang]

Hi,

you can use ZFS native encryption to encrypt your VM/CT.

https://pve.proxmox.com/wiki/ZFS_on_Linux#zfs_encryption

 

[been2siliconvalley]

Thank you for your reply and advice. My question was not regarding the data layer / storage for virtual machines or containers.

I explicitly need to know how to encrypt the Proxmox OS disk.

I don't need to know how to encrypt the data storage for VM's and containers.

For the record, I am already encrypting the VMS and containers using LUKS with ZFS beneath it, and it works perfectly. Everything including sub volumes for containers and VMs and so on.

 

[aaron]

You can set up a Debian with the encryption that you prefer and then install PVE on top of it. https://pve.proxmox.com/pve-docs/pve-admin-guide.html#_install_proxmox_ve_on_debian

The PVE installer has no option to encrypt the disk during installation.

 

[LnxBil]

There is a lot of hackery involved if you need to unlock your OS disk via SSH, otherwise you always have to type in the encryption key at boot via the local or remote console. There was a howto a few years ago there in/on the forums.

 

[been2siliconvalley]

Yeah. I think I will stay clear of Dropbear SSH hacking. I have physical access to the infra, it is my physical private cloud after all. So I don't mind entering the passphrase.

But this is very important! I hope the option of encrypting the root partition will see its way to the standard functionality of Proxmox.

 

[LnxBil]

But this is very important! I hope the option of encrypting the root partition will see its way to the standard functionality of Proxmox.

Encrypting a partition is still possible with LUKS (see aarons comment above), but I think you mean the root dataset with PVE.

 

[been2siliconvalley]

Encrypting a partition is still possible with LUKS (see aarons comment above), but I think you mean the root dataset with PVE.

Yes in ZFS lingo I do. However I would be happy with EXT4 and LUKS just to get the job done.

I will go the hacky road as others have mentioned and linked to. It's not that bad of a procedure.

 

[been2siliconvalley]

Am I really the only one who has a need of this?

 

[lixaotec]

nope @been2siliconvalley

 

[Humanrocket]

I would also like to see support for full disk encryption via PVE installer.

 

[yaboc]

just bumping this up to see if there are any updates on this? also any progress on vTPM?

 

[Dunuin]

Full disk encryption is possible with zfs and lvm but not out of the box.

 

[fpausp]

Simple guide for fulldisk encryption with Proxmox and ZFS native encryption

 

[yaboc]

Simple guide for fulldisk encryption with Proxmox and ZFS native encryption

thanks. i was wondering if anything was added in native installer to make this possible. we try to keep our installs as vanilla as possible but this is definitely a good workaround.