Surgut

Achieving full disk encryption using FIPS, TCG OPAL and LUKS to encrypt UEFI ESP on bare-metal and in VMs Many security standards such as CIS and STIG require to protect information at rest. For example, NIST SP 800-53r5 SC-28 advocate to use cryptographic protection, offline storage and TPMs to enhance protection of information confidentiality and/or integrity. Traditionally to satisfy such controls on portable devices such as laptops one would utilize software based Full Disk Encryption - Mac OS X FileVault , Windows Bitlocker , Linux cryptsetup LUKS2 . In cases when FIPS cryptography is required, additional burden would be placed onto these systems to operate their kernels in FIPS mode. Trusted Computing Group  works on establishing many industry standards and specifications, which are widely adopted to improve safety and security of computing whilst keeping it easy to use. One of their most famous specifications them is TCG  TPM 2.0 (Trusted Platform Module). TPMs are now...

So let's encrypt thing started. And it can do challenges over http (serving text files) and over dns (serving .txt records). My "infrastructure" is fairly modest. I've seen too many of my email accounts getting swamped with spam, and or companies going bust. So I got my own domain name surgut.co.uk . However, I don't have money or time to run my own services. So I've signed up for the Google Apps account for my domain to do email, blogging, etc. Then later i got the libnih.la domain to host API docs for the mentioned library. In the world of .io startups, I thought it's an incredibly funny domain name. But I also have a VPS to host static files on ad-hoc basis, run VPN, and an irc bouncer. My irc bouncer is ZNC and I used a self-signed certificate there, thus i had "ignore" ssl errors in all of my irc clients... which kind of defeats the purposes somewhat. I run my VPS on i386 (to save on memory usage) and on Ubuntu 14.04 LTS managed w...