Now that i covered home servers, time to cover remote servers as i know most people here prefer them.
My next tutorial is about how to acquire them anonymously. very easy with non-KYC cloud providers ( https:// kycnot DOT me/?t=service ) (paying them with monero, accessing them with tor, and accessing the SSH service through tor aswell), will do that tutorial shortly
However the main issue is what's next : how do you hide what you do on that server as much as possible from the cloud provider, for as long as possible ?
I think first you need to have to have a dedicated server, and you need to be able to upload your custom iso there, to make sure that the host OS doesn't contain any monitoring tools.
The host OS should contain packages needed (tor (as a bridge node), libvirt for QEMU/KVM VMs)
Then i think there needs to be a service to make sure that the host OS integrity remains the same (automatic system integrity checks (sha512sum on all filepaths, packages installed,also on all binaries, and libraries) (to avoid any cloud provider from spying in)), and if anything were to change, there should be an emergency shutdown script to be triggered (to keep the VM hidden)
Now for the VM i think it should be LUKS encrypted on the OS level (not sure if this would change much, as the encryption is serverside), and in it would run your sensitive service (ex: nginx, php and tor (which uses the host OS tor service as a bridge node)), of course the goal is that whole setup should be to make it as hard to find for the cloud provider as possible.
Of course, one should not abuse ressources or you would show up as a potential crypto miner, damaging the hardware in the long run
Feel free to criticize it, i'm interested to know how you guys would improve such a setup
Full graph here: http://ss.suragu.net/f/leajb/remote-server-draft.png
BTW the main problem i think is how do you encrypt all of a system's RAM for the host OS, to ward off cold boot attacks. definitely interested in how that can be done
/u/YUKI22 · N/A votes · 20th April, 2024 - 18:41 · Link
[removed]
/u/gemini · N/A votes · 20th April, 2024 - 20:29 · Link
I think runtime binary encryption of the whole OS, so noone can actually peek inside the os while its running.
/u/nihilist1 · N/A votes · 21st April, 2024 - 08:53 · Link
how do you even implement that on a regular debian OS? never heard of such a thing before
/u/auraaura · N/A votes · 21st April, 2024 - 11:17 · Link
I don't think you can do that without hardware level assistance like with Intel SGX. there is homomorphic encryption binary containerization (using homomorph. encr. for memory), e.g. palisade-crypto[.]org, but using it for runtime system binaries is POC territory
/u/zuberdriver · N/A votes · 21st April, 2024 - 23:26 · Link
Re. cold boot attacks, your bootloader creates and mounts a memory mapped drive into which your OS is copied and booted from. Your OS resides in memory and disappears on power down. So now you have an amnesiac system in ephemeral storage but still open to DMA attacks while running however your idea of memory encryption might protect against that. As /u/auraaura pointed out, the memory encryption would need hardware for encryption and key storage at the motherboard chipset level.
/u/nihilist1 · N/A votes · 22nd April, 2024 - 18:29 · Link
yea understood, based on what i looked through, i think memory encryption is not possible unless you have access to the BIOS of the dedicated server or just physical access. however thats probably not possible with most dedicated server offers out there from popular cloud providers.
/u/zuberdriver · N/A votes · 22nd April, 2024 - 21:12 · Link
You can get kvm over ip access to some dedicated servers though it tends to be expensive and offers nothing if the server architecture doesn't provide what you need. Was looking at which intel cpus have SGX extensions, nothing from the older Xeon range that fit my old gaming rig motherboard and they phased out SGX from the latest so my current rig doesn't have it.
/u/zuberdriver · N/A votes · 23rd April, 2024 - 20:05 · Link
Had another look at Intel SGX, there are plenty clearnet resources including docs and drivers from Intel. The newer Xeon cpus have "secure enclave" capacities of 8 to >512GB. I don't fully understand the capabilities but they seem to be designed for running critical code with encryption protection of memory rather than a whole OS. And whether you can just set the use to encrypted ram I doubt it. There's OpenFHEOrg to look at.