LUKS

[czechsys]

Hi proxmox team,

we need luks encryption on pve hosts - only dedicated data disks, not pve. For example, encrypt layer /dev/sdx (hw raid).

1] any chance to use luks+tpm without doing XXX steps on every install/upgrade?

2] if luks+password, whats best way to unlock disks before pve environment starts?

Thanks.

 

[fabian]

Hi proxmox team,

we need luks encryption on pve hosts - only dedicated data disks, not pve. For example, encrypt layer /dev/sdx (hw raid).

1] any chance to use luks+tpm without doing XXX steps on every install/upgrade?

2] if luks+password, whats best way to unlock disks before pve environment starts?

Thanks.

not really related to PVE, just check the cryptsetup docs (man cryptsetup, man crypttab)

 

[LnxBil]

2] if luks+password, whats best way to unlock disks before pve environment starts?

We use Icinga with an event handler.

 

[spirit]

not really related to PVE, just check the cryptsetup docs (man cryptsetup, man crypttab)

It's possible to encrypt from qemu directly too since qemu 2.6

https://people.redhat.com/berrange/kvm-forum-2016/kvm-forum-2016-security.pdf
https://specs.openstack.org/openstack/nova-specs/specs/pike/approved/libvirt-qemu-native-luks.html


could be interessing for example to encrypt on remote storage (ceph rbd), with differents keys for differents customers.