<div dir="ltr">Hi Guus<div><br></div><div>Yeah I kinda thought of that only once I hit the "Send" button .... I guess I have two options , </div><div><br></div><div>1. Manage my own server with public ip address</div><div>2. Trust my VPS provider LOL....</div><div><br></div><div>I read this from digitalocean "Privacy Policy"</div><div><br></div><div><h2 style="margin:0px;padding:0px 0px 0.5em;font-size:19px;color:rgb(87,87,87);font-family:proxima-nova,sans-serif">Server Data</h2><p style="margin:0px;padding:0px 0px 15px;font-size:0.875em;line-height:1.3em;color:rgb(122,122,122);font-family:proxima-nova,sans-serif"><b>DigitalOcean does not have access to its users’ server data. The backend is locked away from the users’ support staff and only engineering staff has access to the physical servers where users’ virtual machines reside. DigitalOcean does not store users’ passwords or private SSH keys. DigitalOcean also does not request user login information to their servers. DigitalOcean does not review or audit any user data.</b></p><p style="margin:0px;padding:0px 0px 15px;font-size:0.875em;line-height:1.3em;color:rgb(122,122,122);font-family:proxima-nova,sans-serif"><b style="font-family:arial,sans-serif;font-size:small;line-height:normal;color:rgb(34,34,34)"><font color="#7a7a7a" face="proxima-nova, sans-serif"><span style="font-size:11.375px;line-height:14.7875px"><u><a href="https://www.digitalocean.com/legal/privacy/">https://www.digitalocean.com/legal/privacy/</a></u></span></font></b><br></p></div></div><div id="DDB4FAA8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><table style="border-top:1px solid #aaabb6;margin-top:30px">
<tr>
<td style="width:105px;padding-top:15px">
<a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank"><img src="https://ipmcdn.avast.com/images/logo-avast-v1.png" style="width: 90px; height:33px;"></a>
</td>
<td style="width:470px;padding-top:20px;color:#41424e;font-size:13px;font-family:Arial,Helvetica,sans-serif;line-height:18px">This email has been sent from a virus-free computer protected by Avast. <br><a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank" style="color:#4453ea">www.avast.com</a>
</td>
</tr>
</table><a href="#DDB4FAA8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1"></a></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr">Regards<br>Yazeed Fataar<br></div><a href="mailto:yazeedfataar@hotmail.com" target="_blank"></a></div></div></div></div></div>
<br><div class="gmail_quote">On Sun, Jan 24, 2016 at 2:36 PM, Guus Sliepen <span dir="ltr"><<a href="mailto:guus@tinc-vpn.org" target="_blank">guus@tinc-vpn.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Sun, Jan 24, 2016 at 01:59:19PM +0300, Yazeed Fataar wrote:<br>
<br>
> So based of this , having your central tinc server in VPS Provider , will<br>
> allow potentially the provider to replicate your config files and thus<br>
> exposing all your remote sites connected. My situation I face is all my<br>
> remote sites have dynamic addresses ,and in order for me to create a<br>
> connection point between the sites is to have a central server in cloud<br>
> with public address. Therefor the VPS seems like the cheapest option and it<br>
> works well.. its the security part I have concerns with.<br>
<br>
</span>Tinc can work with dynamic addresses as well, as long as you have one<br>
node with a fixed domain name, that is fine. Maybe a dynamic DNS service<br>
can work for you?<br>
<span class=""><br>
> There was a option I was thinking of using is creating a encrypted<br>
> partition that I will need to manually decrypt once the server is booted.<br>
> This partition will contain the "/etc/tinc" directory. In this case the if<br>
> someone had to compromise my server they would first need to decrypt my<br>
> encrypted partition.<br>
<br>
</span>That is only the case when the server is down. If they compromise it<br>
while it is running, you will already have unlocked the encrypted<br>
partition and they can still read it.<br>
<div class="HOEnZb"><div class="h5"><br>
--<br>
Met vriendelijke groet / with kind regards,<br>
Guus Sliepen <<a href="mailto:guus@tinc-vpn.org">guus@tinc-vpn.org</a>><br>
</div></div></blockquote></div><br></div>