[asterisk-users] Hide the plain text password

[Dave Platt]

> How about encrypt the whole hard drive?
> 
> If I built a server and give to other people, there is no easy way to 
> stop them reset the root password or just mount my drive to read 
> everything on it. But if build an encrypt OS then it will be secure.  

It will be more secure.  However, you (personally) will need to be
present at the server, every time it is powered up, in order to enter
the appropriate decryption key.

You can't place the key in a file on the hard drive, or as part
of the GRUB or LILO boot configuration, or on a USB stick or
floppy, because if you do, the people you give the server to
will have the information they need to break the encryption.
You would have just "pushed the problem back" by one step.

The only way to keep the encrypted disk (and server) secure,
is to retain physical control of the necessary decryption key.

>                                                           My
> question here are: <1>Is this against Asterisk GPL? 

That depends.  If all of the software on the system is under
GPL Version 2 (or the LGPL equivalent), then distributing such
a system would be no different than distributing a system which
didn't encrypt the disk.  Under the terms of the GPL you would
have to provide copies of the source code to the GPL'ed components
to the system upon request, but you would not have to disclose the
key used for a particular installation,

If you include software which was under GPL Version 3, you might
have to disclose the key.  Ask a lawyer about that.

>                                                <2>How about the
> performance on such a system?

Anywhere from poor, to perfectly fine, depending on how much
disk I/O you do, whether a hardware encryption accelerator is
available, and what encryption algorithm you choose.

If your Asterisk implementation isn't doing a lot of
recording and playback of audio files to/from disk, and
it isn't running other applications at the same time, I suspect
you wouldn't notice a really significant difference between
encrypted and unencrypted operation, once the system had
booted up and was running in a "steady state".