Need full disk encryption or manual image installs

Comments

• MannDude Patron Provider, Veteran

  March 2025 edited March 2025

  On our new plans, that should be available in the next few days or week:

  All nodes will have SME (Secure Memory Encryption) enabled by default. It's an AMD Epyc security feature that offers physical memory encryption on the host node.

  For mission-critical applications and for the truly paranoid, we are testing the implementation of Secure Encrypted Virtualization-Encrypted State (SEV-ES), something we wish to offer for an additional cost or one time fee.

  I'd expect to see others copying this in the future.

  Thanked by 3oloke anonuser1211 buzzyLET
• layer7 Member, Host Rep, LIR

  March 2025

  @anonuser1211 said:
  Looking for a provider that is:

  • Trustworthy and reliable
  • Has history of being able to be trusted with sensitive data
  • Able to provide full disk encryption / or allow custom image installs where I can configure encrypted disks during installation
  • Good laws where server is housed to protect server data

  Hi,

  we provide that by default.
• WebProject Veteran, 🚩 Host Rep Tag Suspended

  March 2025

  You’re welcome to give us a try. You do have the option to install any operating system from your ISO, so you can encrypt the data on your virtual machine.
• oloke Member, Host Rep

  March 2025 edited March 2025

  @MannDude said:
  On our new plans, that should be available in the next few days or week:

  All nodes will have SME (Secure Memory Encryption) enabled by default. It's an AMD Epyc security feature that offers physical memory encryption on the host node.

  For mission-critical applications and for the truly paranoid, we are testing the implementation of Secure Encrypted Virtualization-Encrypted State (SEV-ES), something we wish to offer for an additional cost or one time fee.

  I'd expect to see others copying this in the future.

  Once you're able to get SEV-ES working, I'm buying it instantly.

  Thanked by 1MannDude
• MannDude Patron Provider, Veteran

  March 2025

  @oloke said:

  @MannDude said:
  On our new plans, that should be available in the next few days or week:

  All nodes will have SME (Secure Memory Encryption) enabled by default. It's an AMD Epyc security feature that offers physical memory encryption on the host node.

  For mission-critical applications and for the truly paranoid, we are testing the implementation of Secure Encrypted Virtualization-Encrypted State (SEV-ES), something we wish to offer for an additional cost or one time fee.

  I'd expect to see others copying this in the future.

  Once you're able to get SEV-ES working, I'm buying it instantly.

  Will make a thread once available.

  Thanked by 1oloke
• anonuser1211 Barred

  March 2025

  @MannDude said:
  On our new plans, that should be available in the next few days or week:

  All nodes will have SME (Secure Memory Encryption) enabled by default. It's an AMD Epyc security feature that offers physical memory encryption on the host node.

  For mission-critical applications and for the truly paranoid, we are testing the implementation of Secure Encrypted Virtualization-Encrypted State (SEV-ES), something we wish to offer for an additional cost or one time fee.

  I'd expect to see others copying this in the future.

  Im buying this as soon as its out too

  Thanked by 1oloke
• vicaya Member

  March 2025 edited March 2025

  @MannDude said:
  On our new plans, that should be available in the next few days or week:

  All nodes will have SME (Secure Memory Encryption) enabled by default. It's an AMD Epyc security feature that offers physical memory encryption on the host node.

  I'd be interested if they're Zen4+ EPYCs and Ryzen PROs with TSME (Transparent SME). Otherwise, the host would need enlightened OSes and a TPM, with SecureBoot enabled, which is too much trouble to bother.

  For mission-critical applications and for the truly paranoid, we are testing the implementation of Secure Encrypted Virtualization-Encrypted State (SEV-ES), something we wish to offer for an additional cost or one time fee.

  Hopefully it's not SEV-ES but SEV-SNP, as the former is worse than nothing, IMO, since it provides false sense of security for people not closely following the tech, as SEV-ES threat model is "benign and/or accidental vulnerable" hypervisor, which is chuckle worthy . SEV-ES has well known exploits that are not fixable, and even worse, not detectable via attestation.

  SEV-SNP with guest attestation is the current way to go, which could actually work with compromised host and hypervisor, assuming user with sufficient knowledge in the space.

  I'd be happy to try any provider with SEV-SNP offerings.

  Thanked by 2MannDude oloke