At RemoteRails, we employ a comprehensive, defense-in-depth security architecture designed to protect your data across all states: at rest, in transit, and in use. From baseline hardware protections to advanced confidential computing environments, our infrastructure ensures isolated, verifiable, and highly secure operations.
Advanced Threat Mitigation: Live Server Seizures
A highly sophisticated physical attack involves a “live seizure” or “hot extraction,” where an attacker uses a mobile uninterruptible power supply (UPS) cart to physically remove a server from a datacenter rack while keeping it powered on. This attempts to bypass standard “power-off” disk encryption. Our architecture defends against this via:
- Transparent Memory Encryption (SME/TME): Physical memory modules are encrypted in real-time. If an attacker attempts to logically dump, physically probe, or freeze the RAM on the live machine, the memory contents remain unintelligible ciphertext.
- Hardware IOMMU Controls: Direct Memory Access (DMA) attacks are neutralized. An attacker cannot plug in a malicious peripheral (such as a compromised PCIe network card or a rogue Thunderbolt device) to scrape live memory over the hardware bus.
Baseline Appliance Security
These protections are standard across all RemoteRails appliances – starting from the Cloud / VPS tier and up.
| Security Measure | Technology / Implementation | Threat Defended Against |
|---|---|---|
| Full Disk Encryption | LUKS2 (argon2id) encrypted storage | Protects data at rest if drives are physically pulled, forensically examined, or improperly disposed of. |
| Remote Boot Unlocking | Dropbear Initramfs via SSH (port 2222) | Halts pre-boot sequence until a passphrase is provided remotely, preventing unauthorized boots if an appliance is seized while powered off. |
| Container Isolation | Least Privilege | Application containers are restricted to regular (non-root) user permissions wherever possible. Containers are explicitly granted system capabilities on the host machine where required. |
Dedicated Deployments & Bare Metal
Advanced protections included with both our Dedicated Bare Metal and Hypervisor tiers.
| Security Measure | Technology / Implementation | Threat Defended Against |
|---|---|---|
| Physical Isolation | Single Tenancy | Eliminates cross-tenant, side-channel attacks theoretically possible on shared physical hypervisors. |
| Verified Boot Sequence | Secure Boot & EFI Mirroring with sbctl keys | Establishes a secure chain of trust preventing rootkits. Mirrored across root drives for operational resilience. |
| Memory Protection | IOMMU (AMD Vi / Intel VT-d) | Blocks Direct Memory Access (DMA) attacks by unauthorized physical peripherals (e.g., malicious PCIe cards or Thunderbolt devices). |
| Memory Encryption | SME/TSME or TME (Secure / Total Memory Encryption) | Transparently encrypts system RAM, protecting against live memory probing and cold-boot physical analysis. |
| Storage Resilience | RAID Arrays with LVM Safety Margins | Prevents LVM Thin-Pool auto-extension lockups and VM data corruption during high I/O virtualization loads. |
| Crypto-Shredding | Hardware Vaporization (wipefs + blkdiscard) | Destroys LUKS headers/superblocks and continuously flushes SSD NAND cells for absolute data destruction during emergency resets. |
| Bootloader Bypass | Unified Kernel Image (UKI) via systemd-ukify | Bypasses GRUB completely by wrapping the kernel and keys into a single signed binary. Secures against physical “Evil Maid” attacks. |
Advanced Confidential Computing
The highest level of isolation – available exclusively as an optional add-on for Dedicated Hypervisor deployments – on supported server hardware with AMD SEV-SNP or Intel TDX. The virtual machine boundary provided by Proxmox is required for these Confidential Computing features at the silicon level to have any practical effect.
| Security Measure | Technology / Implementation | Threat Defended Against |
|---|---|---|
| Hardware-Enforced VM Isolation | AMD SEV-SNP & Intel TDX | Cryptographically isolates VM operating memory from the Proxmox hypervisor and other VMs, shifting the root of trust strictly to the CPU. |
| Measured Boot & Attestation | Hardware-backed UKI Verification | Builds upon the UKI to provide absolute mathematical proof (cryptographic attestation) of software integrity before sensitive data is decrypted and processed. |
By layering these hardware, cryptographic, and software-level protections, this defense-in-depth model makes it possible to safely deploy a highly confidential appliance directly within a commercial datacenter. This unique architecture affords you the absolute, “on-premise-like” security necessary for extremely sensitive workloads, while seamlessly allowing you to leverage the immense cost-efficiency, scale, and performance of dedicated host hardware.