[Discuss] Back to the OP: Re: Server/laptop full-disk encryption

[richb at pioneer.ci.net (Rich Braun)]

I'm *still* getting question as to why I want to encrypt my servers.  There's
100,000+ photos on them.  Email from the last 20 years.  Brokerage account and
billing details.  Typical of most anyone's server here.  (I can hear the
voices saying: just put it in the cloud.  Feh. I work in the cloud, trying to
secure it: good luck.) It's 2014, sooner or later all of us are going to want
our data encrypted, whether we work for a spy agency or just want to protect
our families.

Go watch the film "Breakdown" (1997, ref http://www.imdb.com/title/tt0118771/
) for a script-writer's take on the robbery-extortion scenario I'm talking
about.

So let's get past the why, and the seemingly-conflicting requirements. 
Commercial companies have products that address all of these and more, but
aren't particularly easy to use (which is typical of most any enterprise
software or hardware product: people get paid to do installations, which don't
really happen that often, so there's little need to polish the installation
process).  They also cost a lot.

An open-source thing that wouldn't be all that hard to write could set up a
little Raspberry Pi device to act as a key server, where once you set it up
you can then run around to each of the systems on your home (or small-office)
LAN to initialize a token stored locally.  After 15 minutes
token-initialization automatically shuts down, after which each machine (or VM
instance) can then fetch its keys to mount filesystems or reboot: the
handshake would involve the token plus a pass-phrase challenge to be entered
on a web-page console interface on the keyserver device.

This could be made as simple as the typical handshake that occurs with
cordless phones or wireless keyboards, and as secure as SafeNet, but without
the difficulty or expense of such commercial products. But I don't think
anyone's done it yet.

Then if you go on vacation, just take the Raspberry Pi device's boot-SD card
to your safe-deposit box, with a spare copy at a friend's place, and you'll
know for sure no one's going to get your data, period: but you can still talk
your friend through the reboot process if something goes wrong.

-rich