Hello.

Suppose you a new physical disk to a server where you must store sensitive data with the following commands:

1. get disks
2. format and setup with luks2
2. open it
3. fill space with 0
4. format it
5. mount it
6. copy data on it from secure web transfer

Now i am curious, suppose the server gets a shutdown/reboot (power outage) without manually running the `cryptsetup luksClose` cmd on a encrypted container. Is there any possibility that you can access the data without entering the password because you did not closed the container?

You can have physical access to the disk, dump ram memory or even using recovery software.

How about run-time attacks (having access to the server but not knowing user/pass to log in)?

Thank you.

The password/key is stored in the (volatile) RAM, so if the machine reboots, it's gone and the ciphertext is secure.

1 members found this post helpful.

I would use /dev/urandom instead of /dev/zero. If on an SDD type drive, I would probably skip this step. From what I read skipping this on an SDD only increases the risk slightly.


As someone said, no risk. I heard in theory for a short bit of time a Ghost image could be there, but it will be gone rather quickly.

Another concern, if you hibernate, is there a risk of what you asking ? I think there could be.

If machine suddenly shut down, then a RAM attack can be performed, right?

More than that, mounting path gets lost.

From what i know, you can't write on SSD where you want, it actually writes where it wants. What do you mean about increasing the risk? I thought it is healthy to write random data everywhere.

crap, instead of saying "From what I read shipping", I meant to say "From what I read skipping"

You should do a search, I did when I replaced a HDD with a SDD on my main system running Slackware

I saw somewhere that w/LUKS, all people could tell on a SDD where the file is, but that file will be encrypted. That is using LUKs and trim. Plus if you do not trim, then security increases. FWIW, I trim and use LUKs because I doubt the NSA even cares about me. My main concern is theft, and what I do is good enough for that.

But the articles about SDDs and LUKS and trim are very confusing and there are many conflicting statements. So I chose what I think was the best for me, no dd and use trim.

But using /dev/zero is the same as not doing it at all.

For HDDs using /dev/urandom will help a lot with security. For SDDs I do not know.