Linux LUKS encryption security

Hello everybody.

Today i have a tutorial and a curiosity at the same time. Suppose you install a new physical disk to a computer where you must store some sensitive data. You can do this with the following commands:

Find out what is the name of new disk (usualy it is /dev/sdX where X is a,b,c,d)

- Setup and format LUKS

- Open container

- Fill data with 0 before putting any data there

- Format it with ext4

- Mount it somewhere

- Copy data on it from secure web transfer

Let's the server gets a shutdown/reboot (power outage) without manually running the `cryptsetup luksClose safe_data`. Can you access the data without the password. Remember you did not closed the container.

You can have physical access to the disk, dump ram memory or even using recovery software.

What about run-time attacks (like having access to the server but not knowing user/pass to log in)?

What ideas do you have on this?

container gets automatically closed in shutdown / reboot (should not be accessible) as it's being mounted on runtime (you don't mount it on fstab so no worry for that)

But if you have data you can always mount an encrypted folder inside your encrypted partition

the key stays in memory
if you shutdown the key will not be avaialble and data will not be decoded anyway

If you have not closed the LUKS container and the server experiences a shutdown or reboot, the data on the disk should still be encrypted and inaccessible without the password. LUKS encrypts the data at the block level, so even if someone has physical access to the disk, dumps RAM memory, or tries recovery software, they will not be able to access the data without the encryption key.
In terms of runtime attacks, if someone gains access to the server but does not know the username and password to log in, they will not be able to access the data on the encrypted disk. The LUKS encryption protects the data even if the server is compromised.

To further enhance security, you can take additional measures such as using strong passwords, implementing secure remote access protocols, and keeping software and systems up to date with the latest security patches. Additionally, implementing measures like two-factor authentication and monitoring system logs for suspicious activity can help detect and mitigate potential attacks.