I need to send a custom linux machine to client(s) that has a local server database running. The goal is to make them as plug and play as possible.
- Plug ethernet cable into server box
- Plug power cable into server box
- Push power button
- Server starts when it is fully booted
My issue is figuring out the most effective way to safeguard the database data. However, I don't really want the user to do any extra work to login as I don't think I will have a graphics card or any peripherals attached. Basically, I want my grandma to be able to figure this box out.
Something to note: The network this device is on will most likely have only whitelisted incoming connections allowed or no outside connection at all so the goal here is to mitigate a physical intruder.
I've come up with two solutions and it would be greatly appreciated if anyone could take the time to give me their opinions and or any guidance on my viable options; because I'm sure there are a lot more smarter people out there that have better ideas when it comes to these things.
Use a USB key as a mechanism for auto-signing into the machine (PAM Module?). That way the data can be encrypted safely.
While this is definitely the less secure method and a bit more work then I was hoping but - I could delete the files that hold the database data on boot and then have a welcome page on the local server's IP where the user types in the password in which it then restores an encrypted backup on another mounted drive.
This way, the only way the data could be stolen is in between shutting down the device and turning it back on.
A mixture of the two.