Can the vps provider not read everything on your server, unless it’s explicitly encrypted?
I’m asking because I’m interested in self-hosting mainly as a way to get privacy respecting services where good hosted ones don’t exist. I’m not sure I really want to deal with running my own hardware
They have full access to the hardware, everything on it, and all traffic going to/from it. So you need to trust the provider you use somewhat.
If you just want privacy from the usual online services by running some of your own stuff, then that’s totally fine.
If it is in the RAM, they can read it. Since it is a virtual server they can freeze and clone the current state and connect to that copy and read all data that is currently encrypted/opened without you even knowing.
While this is technically true, there is no provider on the planet that can freeze state of RAM in a way that would be useful for this.
It’s technically feasible to recover data on a laptop’s RAM, but not from a virtualized multi-tenant instance tied to a specific user.
there is no provider on the planet that can freeze state of RAM in a way that would be useful for this
You are very mistaken, this is a well-supported feature in most modern virtualization environments.
Here are XenServer docs for it. And here is VMWare’s “high-frequency” snapshots page.
Sometimes, law enforcement authorities only need to contact cloud provider A when they have a warrant for (or, perhaps, no warrant but a mere request for) data about some user C who is indirectly using A via some cloud-hosted online service B.
A(mazon) will dutifully deliver to the authorities snapshots of all of B’s VMs, and then it is up to them if they limit themselves to looking for data about C… while the staff of company B can honestly say they have not received any requests from law enforcement. (sorry my best source on this at the moment is sadly trust me bro; I’ve heard from an AWS employee that the above scenario really actually does happen.)
I’m not talking about snapshots. I’m talking about viewing the RAM of a running instance and having that be useful for anyone who managed to get it. And let me give you two simple reasons why it’s not going to be useful:
- Encryption extensions at the CPU
- Hypervisor resource evictions
Unless you were to go and be on that instance at the exact moment something was happening (or shortly thereafter), that memory is going to be useless.
Now, if someone were absolutely stupid, disabled CPU security extensions at the Hypervisor, AND did something like make a RAM disk and stored something on that-which is really just going out your way to leave a trail-then yeah, maybe you’d get something.
The default of every hosting provider I’m familiar with is encryption by default on absolutely everything from the Hypervisor up except the disk, so I’m seriously doubting the claim of OP unless there is otherwise non-TMB information.
Disk snapshots are another story if unencrypted.
Here’s a snapshot of the memory of a running live cd of Ubuntu. I ran a script to load 0123456789abcdef over and over and it’s clearly readable. Nothing special is required for this, as the Hypervisor has access to anything that the VM does. If the VM loads the encryption key for your disk into memory it will be available to the provider.
Dunno what rock you were hiding under but this is absolutely possible in a hosted environment. There’s even ESXi documentation on how to do it. Taking a snapshot can be detected, but can’t be prevented. These memory dumps can include encryption keys, private keys (such as SSL certificates) and other sensitive data.
Unless you can physically touch the drive with your data on it, I would not store any sensitive data on it, encrypted or not.
Removed by mod
You don’t need to freeze the state of the RAM, you freeze the whole virtual machine - including the virtual RAM.
Did you read the original comment???
What do you think the “v” in “vps” stands for?
I had similar concerns in the past. I decided to move all of my VPS hosted services to a physical server that I control. I then use a VPS as a portal, set to simply forward traffic without unencrypting the HTTPS. Look up SSL pass through.
I use 2 VPN with my setup:
- The private one, hosted on a VPS (OVHcloud). I set it up my self. It’s a bit of work, as you need to take care of properly setting up firewall and reasonably security this server as it is directly facing the Internet. OVH provids some good guides on their website and you can find other resources. You can rent the lowest tire VPS and deploy Debian and Wireguard and you’re all set ! This VPN is for connecting to my NAS at home from outside, and also for secure Internet browsing from public WiFi. This is my own VPN for me and myself (plus my family to a lesser extent).
- The one for Torrenting exclusively Linux ISO of course. This one is a Nord on subscription, and the benefits is not really privacy IMO but rather to be drown into the traffic of thousands of other users.
deleted by creator
Now the mini pc is a server!
Idk how to even attach it to a domain
deleted by creator
Why would they.
Their core business is hosting.
Naturally. It’s their own infrastructure. But there are things you can do. If you choose a provider that lets you install your own OS, then using *nix distros like Debian you can enable encrypted volumes.
