I have a few linux VPS boxes that contain the private keys to Bitcoin. I've taken a few steps to harden them:
- Blocked all ports except those needed for my server with uncomplicated firewall
- Disabled login with password; setup SSH keypairs; disabled root
ssh - clear
sshhistory after typing private key or password
However, I noticed that within my hosting control panel I have the option to Reset Root Password. It seems that despite my hardening the server company has some kind of supervisor access that lets them reset the root password.
How can they reset the root password? Is there a way to harden the server against internal access by the server company? Do I need to enable full disk encryption or home folder encryption?
Best Answer
Short answer: You can't.
Long answer:
Full disk encryption won't save you when it's running. The data is available, decrypted, on your running machine.
The VM provider can clone your machine at any time, especially if it's not encrypted. From the cloned machine, they can mount the system from another machine (like this) and change the root password or examine any information stored on it.
Check out the physical security section at the Arch Wiki. All of their tips focus on the case where you physically own the machine, and you can have some semblance of control over who boots it and what they do when they boot the machine.
If you don't have that, then you have to trust your hosting provider. This includes trust that they won't do something evil to you, and the trust that they will protect you against security threats where other people will do something evil to your VM without their permission.