# Encrypting data at rest
**URL:** https://meta.discourse.org/t/encrypting-data-at-rest/23693
**Category:** Sysadmins
**Tags:** explanation
**Created:** [January 5, 2015, 10:13pm UTC](https://meta.discourse.org/t/encrypting-data-at-rest/23693 "2015-01-05T22:13:45Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@dhyasama](https://meta.discourse.org/u/dhyasama)
#### Post date: [January 5, 2015, 10:13pm UTC](https://meta.discourse.org/t/encrypting-data-at-rest/23693/1 "2015-01-05T22:13:45Z")
For a variety of reasons I’d like to encrypt all data at rest in our private financial forum. What are the options and issues?
At the database level, common approaches are column-specific, whole database, and whole disk. Are any of these possible with Discourse? If so, what are the pros and cons?
For attachments, I’m uploading to S3 and plan to turn on server-side S3 encryption which should be transparent to Discourse. Has anyone tried this yet?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [January 5, 2015, 10:16pm UTC](https://meta.discourse.org/t/encrypting-data-at-rest/23693/2 "2015-01-05T22:16:03Z")
I would recommend
1. Disabling S3 and handling all data yourself
2. Enabling full disk encryption on your linux server
I would strongly recommend not trying to hack the app to support this edge case, its a solved problem.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [January 5, 2015, 11:20pm UTC](https://meta.discourse.org/t/encrypting-data-at-rest/23693/3 "2015-01-05T23:20:29Z")
Option #3 there, to [enable Postgres encryption](http://www.postgresql.org/docs/8.1/static/encryption-options.html), is also a good possibility. But doesn’t cover uploads, images, or attachments of course.. only things stored in the database, which is _most_ stuff in Discourse.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [January 5, 2015, 11:37pm UTC](https://meta.discourse.org/t/encrypting-data-at-rest/23693/4 "2015-01-05T23:37:29Z")
That is basically #2
> Data Partition Encryption
> On Linux, encryption can be layered on top of a file system mount using a “loopback device”. This allows an entire file system partition be encrypted on disk, and decrypted by the operating system. On FreeBSD, the equivalent facility is called GEOM Based Disk Encryption, or gbde.
> This mechanism prevents unencrypted data from being read from the drives if the drives or the entire computer is stolen. This does not protect against attacks while the file system is mounted, because when mounted, the operating system provides an unencrypted view of the data. However, to mount the file system, you need some way for the encryption key to be passed to the operating system, and sometimes the key is stored somewhere on the host that mounts the disk.
The other option for encryption is not applicable
Encryption For Specific Columns requires application level changes
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [January 5, 2015, 11:46pm UTC](https://meta.discourse.org/t/encrypting-data-at-rest/23693/5 "2015-01-05T23:46:27Z")
Oh wow Postgres doesn’t offer table level encryption?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [January 6, 2015, 2:25am UTC](https://meta.discourse.org/t/encrypting-data-at-rest/23693/6 "2015-01-06T02:25:36Z")
yeah you would need to do it column by column, but the general approach is just to do this at filesystem level. simpler.
---
### Author:  [@dhyasama](https://meta.discourse.org/u/dhyasama)
#### Post date: [January 7, 2015, 4:21pm UTC](https://meta.discourse.org/t/encrypting-data-at-rest/23693/7 "2015-01-07T16:21:41Z")
Relevant article for AWS users:
> **[Encrypting Amazon RDS resources - Amazon Relational Database Service](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html)**
>
> Secure your RDS data by encrypting your DB instances.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [March 3, 2019, 7:10pm UTC](https://meta.discourse.org/t/encrypting-data-at-rest/23693/10 "2019-03-03T19:10:29Z")
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 3, 2019, 9:13pm UTC](https://meta.discourse.org/t/encrypting-data-at-rest/23693/11 "2019-03-03T21:13:42Z")
Our current recommendation is:
1. If you are on AWS, rely on AWS features like DB encryption at rest and [S3 server side encryption](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html).
2. If you are self hosting on digital ocean, use OS level encryption, for example LUKS.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [April 2, 2019, 9:13pm UTC](https://meta.discourse.org/t/encrypting-data-at-rest/23693/12 "2019-04-02T21:13:48Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.