Arch Linux Encrypt entire drive

Question

My Pi is set up as a PHP MySQL (Percona) server and I think that I have managed to make it quite resilient against online attacks but it is still very vulnerable against someone just taking out the SD card and reading all my data. I guess I could encrypt the important stuff in MySql but the encryption keys would still be in plain text PHP files and I guess that I could encrypt the PHP and/or MySQL folders but that would all just get complex and there would still be cache and logs etc. to worry about. Someone could probably also see the hashed password and use a rainbow table to crack them. Correct me if I am wrong but as I see it the simplest to manage and most secure solution would be to just encrypt the entire drive (excluding boot and kernel obviously).

Now the only problem is that I cannot really figure out how to do that. The best link I could find was this one https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_Entire_System but as far as I can determine this only explains what you should do for a fresh installation but unfortunately I have already installed a lot of packages and have made a lot of configurations which I would like to keep.

Could someone please explain to me (or provide a link I guess) in simple terms what exactly I should do to fully encrypt my existing Arch Linux installation.

PS. I can understand that for full encryption a key needs to be entered at boot but I could not determine if that requires a physical terminal (screen + keyboard) on the device (which I don't really have but I can get if needed) or if I will be able to do it over the network?

EDIT: Ok, I have found this link https://gist.github.com/pezz/5310082 and my drive is now properly encrypted, all problem is that using ssh to enter the unlock password doesn't work because my key is not accepted when I try to connect from Putty, any ideas? Just a thought but could it be that the root_key file is actually encrypted when Dropbear tries to read it?

Answer 1

When I first read your idea, I thought

1. Why doesn't he protect the system physically in a locked cabinet?
2. This cannot be done! Network and other services (ssh) aren't up at that early stage of booting. There's no way to remotely access a headless system then.

Seems that I was wrong!

Some clever guy has described a setup (although on Debian Wheezy) using dropbear as an early-stage ssh server and busybox to realize exactly what you are thinking about.

I'm not sure about the performance loss due to encryption on a Raspberry-based system. On a netbook, I found it unpleasant, but your mileage might vary.