summary Re: encrypted swap
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 3 lines
Quoted 1 line · David Wagner
You missed some scenarios. Suppose I run a server that uses crypto.
oh, there's lots of scenarios. :) i am definitely in the camp that says encrypted swap is good, though. and that was a good one.
Quoted 1 line · Ben Ford
Wiping swap on boot will achieve the same effect.
1. takes far longer. encrypting swap is not a substantial operation. wiping is. you'd have to wipe all 0's, then a 1010 pattern, then all 1's to get decent security. (encryption is spread out over time - done incrementally. wiping must be done all at once.)
2. anyone stealing a disk to get data out of it sure as hell isn't going to boot it up and run your init scripts.
--
"People blame me because these water mains break, but I ask you, if the water mains didn't break, would it be my responsibility to fix them then? WOULD IT!?!"
- M. Barry, Mayor of Washington, DC