0

I have multiple Hetzner cloud servers (Ubuntu 18.04) and I have encrypted the home directory with a +128-bit encryption using cryptsetup/LUKS. The server may only be accessed with SSH or Wireguard. SSH port is non-standard and we use also fail2ban and password login is disabled. The servers don't have any open ports in addition to the mentioned SSH and Wireguard. These ports are also open only to selected few IP addresses.

As the home directory is encrypted on the fly, should the server be stolen or the disks taken, our data is safe. Also as the server is only accessible via SSH/Wireguard I am not overly worried about unauthorized logins.

What attack vectors there are that I should be worried about? I suppose that cloud server providers have the means to study a running server instance's memory and extract encryption keys. Also some side channel attack may be possible. Any other possibilities? Are there practical attacks that could penetrate iptables? I not worried about DDoS, only the security of our data. I know that state level agencies have their ways and could attack our servers for example via our desktops. But I am mainly interested what are the cloud operator's possibilities to access our data and also are the viable remote attacks?

Seaotter
  • 9
  • 1
  • Please read [ask] for guidance on asking quality questions. Specifically, “what type of questions should I avoid asking?” This question is overly broad, and opinion based. – Appleoddity Jan 25 '19 at 15:58
  • Hetzner can see everything, and they have your encryption key because you give it to them every time you unlock the home directory. See [Is it possible to have a 100% secure virtual private server?](https://serverfault.com/q/484707/126632) for a further discussion of this. Nothing you have on a Hetzner cloud server is inaccessible to Hetzner. If this is important, use a root server instead. – Michael Hampton Jan 25 '19 at 16:02
  • As for other remote attacks, you didn't mention anything about your machines actually running services accessible remotely. No services, no attack surface. Please [post a new question](/questions/ask) specifically about any such services, if you have them. – Michael Hampton Jan 25 '19 at 16:04

0 Answers0