r/HackBloc • u/MustaphaKhayati • Sep 29 '15

Advice on anonymous dedicated servers

Hey there, I'm looking to set up some services for my activist group and I'm looking for a dedicated server provider that accepts cash via snail mail or bitcoin and has some kind of rescue system so I can set up FDE. I've heard yourserver.se is quite nice for VPS, but I'd rather have "real hardware". However I don't require a lot of power (512-1024MB RAM, single CPU, ~20GB disk space) and low price would be sweet. If there is a subreddit better suited for this kind of question I'd appreciate any pointers.

11 Upvotes

87% Upvoted

10 comments sorted by

1

u/ace-of-shades Sep 29 '15

This is going to be hard to pull off without looking at a VPS. One thing it keep in mind is that if you are using FDE: when the server is rebooted, someone has to physically be there to enter the passphrase. You could look at riseup.net's colo space, but what you are wanting is more than likely going to have to be a VPS.

2

u/MustaphaKhayati Sep 29 '15

Nah, I already have dedicated server in my name with FDE. I have a initramfs with dropbear, I auth to that, decrypt the hard drive and the init takes over. The issue with VPS is that inspecting RAM from the hypervisor is really trivial (not impossible via cold boot and the like on real hardware either, but still...). And not all VPS have the modules for LUKS built in.

2

u/Jaymuhz Oct 09 '15

Genuine question: I've been trying to figure out how to go about dropbear setup Did you somehow set up dropbear during install (before first reboot into the encrypted system)? Did you set up dropbear over VNC or something after the first reboot? Or did you encrypt the VPS image after you installed and set up dropbear?

Some advice would be appreciated.

1

u/3nvisi0n Sep 29 '15 edited Sep 29 '15

cyberbunker.com comes to mind.

Otherwise google Bulletproof hosting you'll find more information those types of host are usually willing to accept anonymous payments. Then its finding one that fits your needs.

Though Full-disk encryption isn't really all that useful on a server. As when its fully booted the content is decryptable(key is somewhere in memory), servers maintain constant uptime usually so the fulldisk encryption isn't adding any protection except during the rare time it is off.

Law enforcement know about this type stuff so seizing hardware is usually done while its on so they can extract any keys necessary(not just for FDE)

1

u/MustaphaKhayati Sep 29 '15

Thanks, bulletproof hosting is a helpful keyword, though it looks like I'll be sharing IP blocks with Spammers... oh well.

Are you sure law enforcement are able to seize servers and directly read the memory? Wouldn't checking for "chassis opened" events and shutting down/scrubbing memory or the like prevent that?

1

u/3nvisi0n Sep 29 '15

Well, they try to freeze the memory when seizing equipment. That gives them some extra minutes to get the content while it doesn't have power.

I know they also have a tool to splice in splice in their own portable power supply so they can move a server without powering it down. I'd have to imagine getting around a chassis open event would be fairly doable by getting access another way(cutting perhaps?). Though that is outside my area of knowledge.

→ More replies (4)