From: Demi Marie Obenour <demi@invisiblethingslab.com>
To: LVM general discussion and development <linux-lvm@redhat.com>,
Zdenek Kabelac <zdenek.kabelac@gmail.com>
Subject: Re: [linux-lvm] Can I combine LUKS and LVM to achieve encryption and snapshots?
Date: Tue, 26 Sep 2023 21:43:55 -0400 [thread overview]
Message-ID: <ZROI3igNN/whnc1T@itl-email> (raw)
In-Reply-To: <CAM5YWZfL8zf9=re+VU2MiAQcYvXodqDV-08Zu5RkKUMfkDJ7Tg@mail.gmail.com>
[-- Attachment #1.1: Type: text/plain, Size: 1219 bytes --]
On Wed, Sep 27, 2023 at 01:10:10AM +0200, Jean-Marc Saffroy wrote:
> Hi,
>
> On Tue, Sep 26, 2023 at 10:00 PM Zdenek Kabelac
> <zdenek.kabelac@gmail.com> wrote:
> > Yep typical usage is to encrypt underlying PV - and then create LVs and its
> > snapshots on encrypted device.
>
> Sure, I'd do that in other circumstances.
>
> But in my case it would just be a waste: I am replacing several disks
> on a desktop computer with a single 2TB NVME SSD for everything. Only
> /home needs to be encrypted, and it's tiny, like 100-200GB. Going
> through encryption for most application I/Os would use CPU time and
> increase latency with no benefit.
"No benefit" depends on one's threat model. A surprising amount of
sensitive data gets put outside of /home. For instance, SSH host keys
are in /etc, and system daemons store their data in /var. That's why
the standard is to encrypt the entire drive, except for /boot and
/boot/efi. It's the only way to ensure that sensitive data doesn't wind
up on the NVMe drive, from which it cannot be removed except by
destroying or (cryptographically) securely erasing the drive.
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
[-- Attachment #2: Type: text/plain, Size: 202 bytes --]
_______________________________________________
linux-lvm mailing list
linux-lvm@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-lvm
read the LVM HOW-TO at http://tldp.org/HOWTO/LVM-HOWTO/
next prev parent reply other threads:[~2023-09-27 2:16 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-24 22:09 [linux-lvm] Can I combine LUKS and LVM to achieve encryption and snapshots? Jean-Marc Saffroy
2023-09-26 9:26 ` Harald Dunkel
2023-09-26 20:00 ` Zdenek Kabelac
2023-09-26 23:10 ` Jean-Marc Saffroy
2023-09-26 23:32 ` Stuart D Gathman
2023-09-27 1:43 ` Demi Marie Obenour [this message]
2023-09-27 9:58 ` Zdenek Kabelac
2023-09-27 13:26 ` Roberto Fastec
2023-09-27 15:13 ` Jean-Marc Saffroy
2023-09-27 13:45 ` Jean-Marc Saffroy
2023-09-27 15:40 ` Zdenek Kabelac
2023-09-28 12:23 ` Jean-Marc Saffroy
2023-09-29 13:41 ` Zdenek Kabelac
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZROI3igNN/whnc1T@itl-email \
--to=demi@invisiblethingslab.com \
--cc=linux-lvm@redhat.com \
--cc=zdenek.kabelac@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.