Local-disk encryption to protect against casual privacy loss

Like many others, I store a lot of privacy-sensitive information on the disks of my local server: photos, scanned documents, and more. I do not feel the need to protect that data from those who have physical access to the machine, let alone to protect that data from authorities, should those ever come along with a (mistaken) warrant. No, the protection I seek is much simpler:

The protection I would like is against those who get one of my disks, for example when I exchange a disk under warranty. It would not be the first time that such a disk is resold, or that the friendly shop personnel scan the disk for interesting data. Also, my other server, which sits in a remote datacenter, should not leak information when a disk is exchanged.

The simple mechanism by which I now do this is by accessing the underlying disks (or partitions) of my data disks through dm_crypt , and to create zpools, mdraid, or simple filesystems on top of those dm_crypt mapped block devices. The normal way to do this is to add the required entries to /etc/crypttab, but I find that Ubuntu sets up these devices too late in the game. Therefore, I created my own script.

On my remote server, I have a script in /etc/init.d/local-cryptsetup , which contains:

#!/bin/bash

/sbin/cryptsetup -d /etc/mydevs/passwd.dat create zloop0 /dev/disk/by-id/[NAME_DISK1]

/sbin/cryptsetup -d /etc/mydevs/passwd.dat create zloop1 /dev/disk/by-id/[NAME_DISK2]

In /etc/rc2.d, /etc/rc3.d, /etc/rc4.d, and /etc/rc5.d, I symlink a link called S05local-cryptsetup to the above script. I chose the number S05, as I use these mappings are underlying devices for a ZFS ZPool, and the ZFS subsystem is started at S20. As S05 < S20, this ensures that the mappings are available before ZFS attempts to start using them.

Initializing the ZPool once was easy enough:

# zpool create tank mirror /dev/mapper/zloop0 /dev/mapper/zloop1

I ensures that the pool, and all data in it, successfully survive a reboot.