This makes a world of difference. I know many people may know of it but may not actually do it. It Protects your files in case your computer is ever stolen and prevents alphabet agencies from just brute forcing into your Laptop or whatever.
I found that Limine (bootloader) has the fastest decryption when paired with LUKS at least for my laptop.
If your computer isn’t encrypted I could make a live USB of a distro, plug it into your computer, boot, and view your files on your hard drive. Completely bypassing your Login manager. If your computer is encrypted I could not. Use a strong password and different from your login
Benefits of Using LUKS with GRUB Enhanced Security
- Data Protection: LUKS (Linux Unified Key Setup) encrypts disk partitions, ensuring that data remains secure even if the physical device is stolen.
- Full Disk Encryption: It can encrypt the entire disk, including sensitive files and swap space, preventing unauthorized access to confidential information.
Compatibility with GRUB
- Unlocking from Bootloader: GRUB can unlock LUKS-encrypted partitions using the cryptomount command, allowing the system to boot securely without exposing sensitive data.
- Support for LVM: When combined with Logical Volume Management (LVM), LUKS allows for flexible partition management while maintaining encryption.
I like to keep a key on a USB so the computer boots either with a ridiculously strong backup password or a key on a USB drive. I like tiny little USB drives. So, if you find yourself in an airport or wherever and you just “lose” the USB then the device is automatically locked down.
I built a small set of scripts to decrypt when the initrd starts and can load from a file in the initrd (from separate volume), EFI, or various combinations of passphrase in GRUB. The main intent isn’t to keep out somebody with physical access to the machine and sufficient time but rather makes it a lot easier to make the data unrecoverable when the drive is disposed of.
It took me several attempts to get this right, but it’s a game changer.
Yep, I made sooooo many notes and tried a bunch of different options. In the end I was able to get it working well with Grub,l and Arch.
arch linux was what forced me to use LUKS on all of my installs regardless of distros, btw.
i used the standard layout:/boot, /, /home, swap. So when the installs break, the best way to fix is to use the archiso and remount and re arch-chroot.
Well… i found out that without LUKS, anybody can use any distros live cd and mount my stuff.
At first, I used LUKs only on the main partitions: so / and /home, or just / if no separate /home. Swap remains unencrypted. Boot is also unencrypted.
You could encrypt those too but need more work and hackery stuff:
-
encrypted boot: can be slow if you boot the compututer from cold. There’s also this thing where you need to enter the password twice => think Fedora has an article to get around this. Iirc, it involves storing the boot’s encrypted password as a key deep within the root directory.
-
encrypted swap: the tricky thing is to use this with hibernation. I managed to get it to work once but with Zram stuff, I dont use hibernation anymore. It involved writing the correct arguments in the /boot/grub/grub.cfg. Basically tells the bootloader to hibernate and resume from hibernation with the correct UUID.
-
I found it better to just encrypt one folder with all my sensitive info (I use gocryptfs). i saw no reason to have my zshrc and init.lua encrypted 🙂 and I just encrypt data I don’t want in the hands of others…
Browsing history, Downloads folder, cache, etc. That’s good to have encrypted.
Just encrypt your home then.
Don’t forget /tmp, and maybe logs too. Theres docker storage and kvm image locations if you use that. Maybe others. FDE also makes an evil maid attack much less trivial too.
I don’t know, I don’t see a lot of damage or unpleasantness stemming from someone getting into my /tmp, but I don’t want any llm being fed contents of my /home. I am less afraid of an attack, as I am irked by corpos putting fingers into my shit
Dang, if those agencies ever see my Civilization 4 save games, I’ll be so royally embarrassed that I spent so much time on it that they could blackmail me to anything.
I wanna encrypt my BTRFS system, but not the FAT32 boot part. Only the Linux kernels are on FAT32 anyway, and I don’t care about encrypting those — they’re public stuff, not private files. I just let limine-entry-tool hash them to make sure they’re clean for booting, that’s totally fine for me.
I don’t like putting kernels on the Linux filesystem for GRUB — it just makes booting slower and causes random issues.
Pretty much all beginner friendly distros have this thing (Fedora Debian Ubuntu Mint). You just have to enable it. Also make sure if you are using secure boot - remove Microsoft keys and generate your own. Also its nice to have bios password setup too.
It’s easy-- if you install on a single drive. If you want home on a separate drive, encryption is not so easy, and you have to learn about cryptsetup, crypttab, etc. Quite a steep learning curve compared to the installer. I do hope distros provide better coverage of this in the future. Having home on a separate drive and encrypted is just good practice.
Also: back in the day, you could wipe a drive with GNU Shred or just “dd if=/dev/zero of=/dev/hda”. SSDs and NVMe drives have logic about where and what to overwrite that makes this less effective, leading to the possibility of data recovery from old drives. If the data is always encrypted at rest and the key is elsewhere (not on the drive, in a yubikey or TPM chip or your head), then the data is not recoverable.
Also: encrypt everything you upload to the cloud with Cryptomator or something like that. I amazes me I used to put stuff directly in my pCloud folder.
Cryptomator is good but it’s important also to keep backups of the unencrypted content of the Cryptomator vault that are not encrypted by Cryptomator. (You could encrypt the backups with another system.) Cryptomator vaults are more fragile than the underlying file system, and it’s easier for a glitch in the sync process to corrupt them so they’re unrecoverable. I have lost data due to this in the past. So it’s best to make sure all the contents of your vaults also exist somewhere else, encrypted in another way.
I used borg for my backups, but why do you say Cryptomator vaults are fragile?
It’s not that they’re especially fragile. It’s really only when you combine them with a sync process. I once had a sync go wrong and it resulted in the contents of a vault being unreadable. Because all you have are a bunch of encrypted files with meaningless names and a flattish structure, which Cryptomator interprets and mounts as a different directory structure, when something goes wrong it’s not easy to know where in the vault files the problem lies. You can’t say “ah, I’m missing the documents folder so I’ll restore that one from backup” like you could with an unencrypted directory. And if you’ve made changes since the last vault backup you can’t just restore the whole vault either. You could mount a backup of the vault from a time when it was intact, and then copy files across into your live copy, but I feel safer having a copy in another format somewhere else. Not necessary, I guess, but it can make recovery easier.
Ok, I understand. In my particular use case that shouldn’t be an issue. My Cryptomator folder is local and I use it only locally. Then there’s a sync process to copy stuff to pCloud automatically, but that copy is never touched directly by my.
But in any case as you said, backups.
Because he experienced data loss, as he says?
easy to use gui backup utilities (like pika and déjà dup) can also encrypt its backups
Facts. I put everything on cloud (mega only) compressed with AES-256
compressed with AES-256
I guess you mean encrypted.
No I meant compressed, it comes with the encryption.
how is the state of TPM unlocking atm? i don’t do it because i use my computer remotely, and having to locally unlock it would break the setup. on my laptop sure, always encrypted.
What about data safety, backups etc.? If someone has access to my PC, that is already pretty catastrophic.
They can’t access your files, they just have your computer. They could delete your files by wiping your drive but they don’t have your files, ensuring your privacy
Good question. Along the same lines, if your disk is encrypted and you make a simple backup (say using cp) is the backup encrypted and if so, how do you restore from that?
if your system uses full disk encryption (such as via LUKS) and you simply copy files off to an external or a secondary drive for a ‘backup’, no. the copy is not encrypted unless the destination has encryption set up on it, too.
the alternative would be using a backup program, instead of a simply file copy, that encrypts its backups.
It depends how the backup is encrypted. Most backup solutions will give you an encryption key, or a password to a key, that you have to keep safely and securely somewhere else. If you have an online password manager or a Keepass database in cloud storage, that would be a reasonable place to keep the key. Or on a USB stick (preferably more than one because they can fail) or a piece of paper which you mustn’t lose.
dmcrypt for backup drives. Ideally with detached encryption header, stored separately.
I’ve been doing that since like was first introduced as a separate library already. I don’t know better than that all my files are encrypted since well over a decade, probably almost two
The same issue applies to Windows 10. I think the TPM (and a BIOS password) is supposed to address this for Windows 11 but I presume you could flush the NVRAM and access the files anyway. I don’t know what exact safeguards there are.
Either way, I am far more trustful of passwords I enter myself. Such as wafersGeezAfterCraze.
