I understand LUKs can be used to encrypt your data. But what would prevent somebody plug in a USB with and just wipe my drive?
On traditional BIOS like Lenovo, HP, Dell and even Framework you can set a supervisor password that locks the boot menu. So nobody can boot from the USB.
Coreboot is different though. I spoke with Starlabs whose computers run Coreboot, and apparently you can have the boot menu password. OTOH, Sys76’s Coreboot doesnt allow such things.
I ask because i want to libreboot my T480, but the number 1 thing i worry is unauthorized USB boot.
This one: https://libreboot.org/docs/linux/grub_hardening.html#grub-password
seems to only lock the ability to edit the grub entry freely, aka press “e” to change stuff when grub fails to boot.
Disable the boot menu and set a password on your UEFI before considering Libreboot.
You could make it about equivalent to the protections afforded by the typical BIOS password, i.e. the attacker must first disassemble your laptop to reflash the spi chip or pull the hard drive. A
grub.cfglike so would do, assuming everything in encrypted partitions:set prefix=(memdisk)/boot/grub set superusers="myuser" password_pbkdf2 myuser grub.pbkdf2.sha512.10000.<your hashed password> cryptomount -u <UUID of LUKS container> search.fs_uuid <UUID of the root filesystem under LUKS container> root cryptouuid/<UUID of LUKS container> configfile ($root)/@rootfs/boot/grub/grub.cfgAssuming you boot directly to GRUB or locked out the SeaBIOS boot device selector, then GRUB will only ever look for a boot device matching your disk’s UUID; attempting to do anything else aside from entering the LUKS passphrase will prompt for the GRUB password. You’d still have your own recovery path by pressing Esc, entering your GRUB password, and dropping to the GRUB shell. Bonus points for patching the GRUB code so it doesn’t echo the UUID of your disk.
No, it isn’t bulletproof against physical access. But yes, I had the same question you did when starting out with coreboot and this was the solution I came up with.
Reading the comments makes me wonder why BIOS passwords were even invented.
Sounds like everyone is saying its a waste of time and to never use it if the biis supports it.
BIOS boot passwords were from another era with different needs and assumptions. In controlled access environments they can still have an impact if you have a proper chassis that has locks on it preventing removal of drives. Most normal people don’t possess such business class chassis. The scenario was a business environment with security teams, other employees, supervisors and locks that while you could cut them with heavy equipment you’d be noticed doing so. In terms of preventing a team of thieves breaking in with power tools and stealing things true it never was meant to prevent that. It’s more authorization and access control within an organization. The idea being perhaps the CEO’s machine or a special machine for accessing sensitive devices would be physically locked and have such a password installed as another layer of security that couldn’t be bypassed surreptitiously.
Additionally back in the day these BIOS boot passwords were paired with chassis intrusion alarms which went off every subsequent boot if the chassis was opened thanks to a sensor and the only way to clear that alarm was logging into the BIOS with an admin password.
Your gaming computer BIOS supports neither of these nor does your gaming motherboard have a chassis intrusion connector nor does your gaming case come with support for such a device.
But it was never about preventing data destruction even in these cases. It was more preventing access and making any such access more time consuming and likely to trip alarms to allow a response including evaluation of compromise by professionals.
If you want to protect your data make backups. If you want it well protected against determined parties who want to destroy all copies and/or thieves then locate a copy off-premises. If you can’t do that at least locate a copy within a bolted down safe.
I have a t480 here. It took me about five minutes to unscrew the bottom panel, remove the ssd and replace the bottom panel like before.
Just make regular backups and practice restoring from them.
