Ways to secure / encrypt HA configuration files?

Hi

I want to ensure that the configuration I put in place for HA cannot be accessed / altered by anyone other than me.

What would you say is the best way to do that ?

Don’t give anyone your credentials for the machine.

1 Like

There are a number of threads here on securing your HA system, I’d highly advise taking the time to search and read them.

In addition to the advice given, the short version is:

  1. Secure the host running HA
  2. See (1)

You don’t need to do anything special, beyond what you’d do for any other service.

Hi

Thanks for responding .

I had done a number of searches before submitting the question (I’m old-skool like that :slight_smile: ) but everything that came up seemed to be about securing the connection (SSL/certs etc) not the actual configuration data.

As people will need full access to the box HA is running on / they could see the configuration files etc. hence the curiosity if it would be possible to secure all the HA settings separately on the device - e.g so not even root has access?

Maybe some second layer of security ?

Thoughts ?

If they have root access then they can read all the files. There’s no way around that.

What follows is general for all computers and all software

Let’s say you encrypted the files. How would HA read them? Either:

  1. It would have to be able to decrypt them
  2. Something else would have to decrypt them first

In the second case, the files are then unencrypted and so readable by root. In the first case, root can read everything HA can, so it can read the decryption key. It can also read the software and so know how to use the key. Indeed, because it can read everything, it can read the decrypted files from memory…

More practically though, anybody with root access can just use su to become any other user, and read the files that way. If you don’t trust the person with root access on a system, don’t use that system.

TL/DR: You can’t stop the signal root from doing anything it wants.

Many Thanks @Tinkerer

I was obviously being too optimistic for there to be a way.:slight_smile:

So in summary / ensuring that no one has root access is the only real course of access in controlling / securing a HA configuration ?

Pretty much, but that’s not special to HA. Access to the root account grants total control, that’s the nature of root.

The answer is, buy a Raspberry Pi 3 and dedicate it to HA :wink:

Virtual Machines are another great way to silo things.

Except of course, the root account of the machine running the VMs can still access everything on those VMs. It’s not as trivial, admittedly, but it’s still easily do-able if you’ve got the skills, or are willing to spend some time with Google.

It’s the same “problem” as always - you have to be able to trust the hardware (virtual or physical) and those with administrative access (to the system, and its backups). If you don’t, then you shouldn’t do anything you’d consider sensitive.

1 Like