Security
What is LUKS?
LUKS is the standard Linux full-disk encryption format, storing key material in a header on the encrypted volume itself. On a VPS it protects data at rest against physical seizure and disk decommissioning. It does not protect against an attacker with access to the running hypervisor, because the key is in memory while the machine runs.
Why LUKS matters
On a VPS it protects data at rest against physical seizure and disk decommissioning. It does not protect against an attacker with access to the running hypervisor, because the key is in memory while the machine runs.
LUKS in practice
When running LUKS on a server, the header is the first thing to check: it holds the key material and lives on the volume itself. You will handle it during initial setup, where you choose the passphrase and cipher. Changing the passphrase later means re-encrypting the header. Get the header wrong—lose it or corrupt it—and the data is unrecoverable, no matter what else you try. It costs you availability and, if you are careless with backups, everything.
What people get wrong about LUKS
People conflate LUKS with encryption that protects the running system. It does not. Once the volume is unlocked, the key sits in memory, and anyone with hypervisor access—as on a VPS—can read it. The misconception: LUKS is a shield for your data at rest, not a wall around a live process.
LUKS — common questions
Can I change the LUKS passphrase on a running server?
Yes. LUKS stores multiple key slots in its header, and you can add or remove keys while the volume is unlocked. The operation rewrites the header, not the data. Run cryptsetup luksAddKey or luksRemoveKey, and the change applies immediately.
Does LUKS slow down disk I/O on a VPS?
There is overhead from encrypting and decrypting every block. Modern CPUs handle AES-NI instructions, so the impact is small—often a few percent. But on lower-powered plans you may notice it. Benchmark before committing to the performance trade-off.
Where LUKS comes up
- How do I reset a forgotten root password? Use the out-of-band VNC console in the panel, reboot into single-user or rescue mode from the bootloader, remount the root filesystem read-write and run pa…
- Full-disk encryption on a VPS with remote unlock LUKS2 with a dropbear SSH daemon in the initramfs lets you encrypt the root filesystem and supply the passphrase remotely at every boot. The provider never…
- Is full-disk encryption useful on a VPS? Against physical seizure of a powered-off disk, decisively yes: the volume is ciphertext without your passphrase. Against an attacker with access to the ru…
- Can my hosting provider see the files on my VPS? Technically yes: any provider with hypervisor access can read an unencrypted guest disk and its memory. That is true of every virtualisation platform. What…
- Can my VPS be seized? Physical seizure of hosting hardware is rare and requires a criminal warrant executed at the datacentre by local authorities. It is far more common for an …
More from security
- DDoS
- A DDoS attack floods a target with traffic or expensive requests from many sources at once, to exhaust bandwidth, connection state or processing capacity.
- Traffic scrubbing
- Scrubbing routes traffic through filtering infrastructure that discards attack packets and forwards legitimate ones.
- Null route
- A null route discards all traffic to an IP address, protecting the wider network by making the target completely unreachable.
- fail2ban
- fail2ban monitors log files for repeated authentication failures and temporarily firewalls the offending addresses.