Member
Proof without prior knowledge exists. It's called a cryptographic attestation. TPM quote, signed by the hardware, includes the PCR values that identify the specific boot chain.
But no datacenter remote hands is running tpm2_quote for you. The tooling gap is real.
What about a simple dead man's switch? Leave a file on the correct server. Remote hands must delete it as step 1. You watch for the deletion. Wrong server, file stays, alarm rings.
This is actually useful for planned work. But for emergency power cycle at 3am, the file check is backwards: I need to know they touched the RIGHT server, not that they touched A server.
Still, combining: file must be deleted from correct server, then PDU log must show cycle on correct outlet. Two factors.
All this verification and nobody mentions the cheapest: buy from providers who don't suck. Contabo's remote hands is €30/half-hour and I've had one mistake in four years. OVHcloud's included "support" is worth exactly what you pay.
You get what you don't pay for.
Contabo remote hands cheap but slow lor. My urgent ticket 6 hours response. For verification I rather pay more and sleep.
But svendeal got point. Provider quality > verification complexity. I still verify, but less paranoid.
Has anyone tried the barcode/QR on the server? Ask them scan it, send photo. Still fakeable but higher effort than wrong serial.
QR is just a serial number in picture form. Same problem: they can photograph the wrong server, or photograph the QR from the correct server and tape it to the wrong one.
I need something that requires the machine to DO something.
