• modem_down@thebrainbin.orgOP
    link
    fedilink
    arrow-up
    5
    arrow-down
    2
    ·
    7 hours ago

    Yes. Here are some common self-hosting scenarios:

    • Home server containing family files: scans, photos, device backups, …
    • Office server containing business files: sensitive documents, device backups, …
    • Web or email server containing websites, Fediverse instances, emails, etc

    In all those cases, full disk encryption (FDE) is a sensible precaution to protect the data in case the server is physically stolen.

    Linux is probably the most common OS kernel for self-hosting. On Linux, LUKS (Linux Unified Key Setup) is probably the best FDE system. It’s mature and reliable. But anyone self-hosting a Linux server with LUKS FDE is faced with the question of where to store the keys.

    Hardware security tokens (HSTs) are widely considered a safer place for keys than SSDs, HDDs, or USB storage. They follow the smartcard principle: a private key can be written to an HST but not read from it (security vulnerabilities excepted). Instead, they implement cryptographic algorithms to prove possession of the private key. So, anyone self-hosting a Linux server with LUKS FDE should strongly consider storing their private key(s) on an HST.

    However, there is more than one way to do that. Hence the question in my OP.