Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What Do You Use for Linux Full Disk Crypto?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 51 posts

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#31

Post by r3bl »

wheelerwj wrote: post #9
Daniel_sk wrote: post #3

I wish it was so easy as on MacOS or Windows - where you can essentially turn it on with one button. I don't think enabling encryption on an existing installation of Linux can be done without reinstalling or a lot of work.

on MacOS its pretty easy... i use it, i think? and Windows its relatively simple too since they added BitLocker in 10. i think every os supports it?

> and Windows its relatively simple too since they added BitLocker in 10.

Not really. OEM installs have it, but Windows 10 Home doesn't. If you're on an OEM install and decrypt the hard drive once, you won't be able to re-encrypt it without paying for a Pro upgrade. That mistake costs $100.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#32

Post by saint_abroad »

xorcist wrote: post #26

LUKS can use a central recovery key. Regular users can't mess with LUKS settings.

+1

> a more enterprise solution where I can store a recovery key centrally that a user can’t remove.

The enterprise solution is to not give users administrative privs.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#33

Post by Faaak »

jusssi wrote: post #12
mrkeen wrote: post #6

During installation, I tick the box that says 'full disk encryption'.

Which distro are you using? The last I tried with Ubuntu, it "just didn't work", i.e. failed with very unhelpful error message. Bonus points if it's possible to install to a partition in existing FDE container (saves a /home backup-restore external drive round trip).

Works well for me on Ubuntu 18.04 and 18.10

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#34

Post by dopeboy »

ergo14 wrote: post #11
wheelerwj wrote: post #7

Earlier quoted context omitted.

this. it was the easiest thing ever.

Only if you want to have a single partition :( If you want to have separate ones you have to do manual dance around luks. I'd wish it was easier to set up for multiple partitions.

I just ran into this when I installed ubuntu and wanted to preserve dual boot. Definitely more room for improvement on the "Just Works" front here.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#35

Post by throwaway9d0291 »

rb666 wrote: post #5

(very soon) ZFS! It's happening: https://github.com/zfsonlinux/zfs/releases The PR started 3 years ago: https://github.com/zfsonlinux/zfs/pull/4329

It's a shame it cripples the performance though. It roughly quartered sequential read/write for me.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#36

Post by jason_slack »

Actually, this poses a question. I have disk encryption enabled on my laptop.

Now I want to put in a larger hard drive and clone the current drive on to it. Without disk encryption I could use clonezilla or other tools. With disk encryption enabled I can't seem to do anything to clone.

What is a solution?

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#37

Post by Leace »

throwaway77384 wrote: post #4
Daniel_sk wrote: post #3

I wish it was so easy as on MacOS or Windows - where you can essentially turn it on with one button. I don't think enabling encryption on an existing installation of Linux can be done without reinstalling or a lot of work.

Ackchually, enabling full disk encryption via LUKS is rather easy on Manjaro. It's literally a button that states "use full disk encryption" as part of the setup wizard. You then enter a password and that's it. The tricky bit is if GRUB breaks (hint: GRUB looks for every opportunity to break. If it can break, it will) and you have to chroot into an encrypted LUKS partition. That's where your average user will be SOL.…

For modern setups that support UEFI, GRUB is unnecessary as you can boot Linux kernel directly as EFI executable.

If one cares about SecureBoot then this package automates everything: https://github.com/andreyv/sbupdate (it's setup only once and works later without supervision).

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#39

Post by chopin »

saint_abroad wrote: post #30
chopin wrote: post #27

Earlier quoted context omitted.

For me, not so much. I installed Mint and skipped the step (as to not to introduce more complexity the first time), thinking 'I can do that later'. The disk is still unencrypted... Is there a way to do this and to restore the system state (installed software etc.)? DuckDuckGo didn't reveal anything conclusive. Could anybody comment on the convenience of Linux encryptions (eg. LUKS)? In Windows, encryption is totally…

> In Windows, encryption is totally transparent to users (I need only to type the account password). With transparent encryption, Windows decrypts the disk at boot using the TPM. Prior to login the disk is already mounted (decrypted). It provides an easy way for enterprise to say, "yes- we have FDE".

So there is no protection if the entire device is stolen (or put in a backroom at a border)? You can just boot it up and acess the disk without having a user? The Wikipedia page on Bitlocker does not mention this problem for TPM mode. Or is only a part decrypted until a user logs in?

Edited to add: The best I could find was this discussion: https://www.reddit.com/r/sysadmin/comments/5fllep/whats_the_...

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#40

Post by ornitorrincos »

jason_slack wrote: post #36

Actually, this poses a question. I have disk encryption enabled on my laptop. Now I want to put in a larger hard drive and clone the current drive on to it. Without disk encryption I could use clonezilla or other tools. With disk encryption enabled I can't seem to do anything to clone. What is a solution?

Haven't done it, but as a first guess.

prepare an encrypted partition in the new disk and mount both origin and destination with cryptsetup.

now use clonezilla to clone the partitions, not the drives.

Post reply on HN