I've got a number of older hard drives I'd like to destroy to the point where ordinary effort by someone like me makes them unreadable. I tried drilling a hole through one of them, and it worked, but it was surprisingly hard to do, the hard drive case is I guess fairly hard steel.
I'm thinking I should probably do encrypted drives from now on. The time cost to wipe drives by writing random data is in the hours and hours now.
@dlakelan you can use LUKS with a key file instead of a passphrase, that should do what you want (if I'm understanding correctly)
https://wiki.archlinux.org/title/Dm-crypt/System_configuration#Unlocking_with_a_keyfile
Can you do it at boot though? Like, / is encrypted and an initramfs knows to mount the /keys partition and grab the keyfiles there?
It's probably good enough for me to do /home on an encrypted partition and have / mount /keys and use that for keyfiles for /home. You don't learn much by knowing what software I've installed on /
For manual control and maximum security on a few systems, use Method 1 (Dropbear SSH). It is reliable and simple to set up.
For a fleet of servers that require automatic reboots, Method 2 (NBDE with Clevis/Tang) is the best choice, offering a centrally managed and automated solution.
If your server has the necessary hardware and you need fully automated reboots without network dependency, Method 3 (TPM) offers a highly secure and convenient option.
Daniel Lakeland
Julio J. 🀲
slatey
Alexey Abramov