> How about encrypt the whole hard drive? > > If I built a server and give to other people, there is no easy way to > stop them reset the root password or just mount my drive to read > everything on it. But if build an encrypt OS then it will be secure.
It will be more secure. However, you (personally) will need to be present at the server, every time it is powered up, in order to enter the appropriate decryption key. You can't place the key in a file on the hard drive, or as part of the GRUB or LILO boot configuration, or on a USB stick or floppy, because if you do, the people you give the server to will have the information they need to break the encryption. You would have just "pushed the problem back" by one step. The only way to keep the encrypted disk (and server) secure, is to retain physical control of the necessary decryption key. > My > question here are: <1>Is this against Asterisk GPL? That depends. If all of the software on the system is under GPL Version 2 (or the LGPL equivalent), then distributing such a system would be no different than distributing a system which didn't encrypt the disk. Under the terms of the GPL you would have to provide copies of the source code to the GPL'ed components to the system upon request, but you would not have to disclose the key used for a particular installation, If you include software which was under GPL Version 3, you might have to disclose the key. Ask a lawyer about that. > <2>How about the > performance on such a system? Anywhere from poor, to perfectly fine, depending on how much disk I/O you do, whether a hardware encryption accelerator is available, and what encryption algorithm you choose. If your Asterisk implementation isn't doing a lot of recording and playback of audio files to/from disk, and it isn't running other applications at the same time, I suspect you wouldn't notice a really significant difference between encrypted and unencrypted operation, once the system had booted up and was running in a "steady state". -- _____________________________________________________________________ -- Bandwidth and Colocation Provided by http://www.api-digital.com -- New to Asterisk? Join us for a live introductory webinar every Thurs: http://www.asterisk.org/hello asterisk-users mailing list To UNSUBSCRIBE or update options visit: http://lists.digium.com/mailman/listinfo/asterisk-users