Linux
Welcome to c/linux!
Welcome to our thriving Linux community! Whether you're a seasoned Linux enthusiast or just starting your journey, we're excited to have you here. Explore, learn, and collaborate with like-minded individuals who share a passion for open-source software and the endless possibilities it offers. Together, let's dive into the world of Linux and embrace the power of freedom, customization, and innovation. Enjoy your stay and feel free to join the vibrant discussions that await you!
Rules:
-
Stay on topic: Posts and discussions should be related to Linux, open source software, and related technologies.
-
Be respectful: Treat fellow community members with respect and courtesy.
-
Quality over quantity: Share informative and thought-provoking content.
-
No spam or self-promotion: Avoid excessive self-promotion or spamming.
-
No NSFW adult content
-
Follow general lemmy guidelines.
view the rest of the comments
If you want the OS to boot before it decrypts your drive, why encrypt it in the first place? Honest question, not an attack. For OS to boot without any password it needs to be booting from unencrypted drive. So the attacker could just put their keyloggers on that drive
Yes. Just encrypt /home partition only
I’ve run into a few reasons:
Generally though I think OS encryption isn’t that important (verification is) vs protecting user data.
I don't think I've heard about some boot-time checksum verification of root partition. Doesn't mean it does not exist, just that I can't help here
My point is: if OS is not encrypted, it can be modified. And that verification idea, if is not stored under some encryption, could also be changed. Which means that by the time you put in your password to decrypt your home, you might be already running system that will nullify the protection. Encrypting your drive will only protect you in scenarios when someone snatches your device turned off
This is dangerous. As some data like cache and logs are stored in the root partition. So some of your data from home partition might trickle up the root partition in that form.
My threat model doesn’t include someone gaining direct access to my home desktop. I have Arch Linux with Secure Boot and TPM 2.0 enabled on fully encrypted drive and this chain’s existence makes it easier to know that no one has tampered with my system. On my laptop I am one step further with requirement of BIOS password.
Hence my point about why bother at all. Without full encryption one gets leaks. With full encryption some kind of secret is required. Either password (hence that need of keyboard in earlier comment) or a key, etc
In order to not need a secret during boot, critical parts have to be exposed
Theoretically one could also put logs and cache on encrypted volumes. Maybe that could be some solution. I have in the past had
/var/logson separate partition, so it didn't make/run out of space. Linux had no issue with that. But that still leaves kernel and OS exposedThe comment I responded to mentioned:
I don't think you are talking about the same setup and vectors. Their point was to not have fully encrypted drive, so it boots without a prompt
You can achieve this even with full disk encryption with Secure Boot and TPM. That’s how Bitlocker does it. I have this setup on my Desktop — One single root partition with LUKS, Secure Boot on with sbctl and cryptenroll for tpm unlocking. Takes less than 5 mins to setup.
Well, TIL
When Windows users had to switch versions because of TPM I was not paying attention, I run Linux everywhere. Apparently there can be some use of TPM
But then, without a separate stage of encryption (like encrypting
/homeadditionally), the system will just boot up with the data available. It can still be messed with