Ask HN: What Do You Use for Linux Full Disk Crypto? • Hacker News Board

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#11

Post by ergo14 » Mon, Mar 04, 2019, 8:51 AM UTC

wheelerwj wrote: post #7

mrkeen wrote: post #6

During installation, I tick the box that says 'full disk encryption'.

this. it was the easiest thing ever.

Only if you want to have a single partition :( If you want to have separate ones you have to do manual dance around luks. I'd wish it was easier to set up for multiple partitions.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#12

Post by jusssi » Mon, Mar 04, 2019, 8:52 AM UTC

mrkeen wrote: post #6

During installation, I tick the box that says 'full disk encryption'.

Which distro are you using? The last I tried with Ubuntu, it "just didn't work", i.e. failed with very unhelpful error message.

Bonus points if it's possible to install to a partition in existing FDE container (saves a /home backup-restore external drive round trip).

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#13

Post by qalmakka » Mon, Mar 04, 2019, 8:57 AM UTC

rb666 wrote: post #5

(very soon) ZFS! It's happening: https://github.com/zfsonlinux/zfs/releases The PR started 3 years ago: https://github.com/zfsonlinux/zfs/pull/4329

I've been using ZoL-git with Datto's encryption since 2017 on my main systems. It's really really solid and makes the management of encrypted datasets a breeze (even send and receive are supported). Yes, probably is slightly less sicure than LUKS/GELI and similar block-level encryptions, but I personally do not care that much. I can't wait to see it in stable ZoL and in FreeBSD (I'm also kinda hyped for ZoF, which I hope will allow to share easily pools between Linux and FreeBSD)

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#14

Post by jstanley » Mon, Mar 04, 2019, 9:04 AM UTC

mrkeen wrote: post #6

During installation, I tick the box that says 'full disk encryption'.

OP specifically stated:

> I know you can do FDE with LUKS but would prefer a more enterprise solution where I can store a recovery key centrally that a user can’t remove.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#15

Post by Biskit1943 » Mon, Mar 04, 2019, 9:17 AM UTC

rb666 wrote: post #5

(very soon) ZFS! It's happening: https://github.com/zfsonlinux/zfs/releases The PR started 3 years ago: https://github.com/zfsonlinux/zfs/pull/4329

Can you explain to me why i should use zfs instead of ext4?

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#16

Post by mrkeen » Mon, Mar 04, 2019, 9:18 AM UTC

jstanley wrote: post #14

mrkeen wrote: post #6

During installation, I tick the box that says 'full disk encryption'.

OP specifically stated: > I know you can do FDE with LUKS but would prefer a more enterprise solution where I can store a recovery key centrally that a user can’t remove.

OP may have stated LUKS, but the Ubuntu installer doesn't.

https://i.stack.imgur.com/6Heoq.png

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#17

Post by majewsky » Mon, Mar 04, 2019, 9:18 AM UTC

What problem are you trying to prevent?

- A novice user fatfingering `cryptsetup luksRemoveKey`? Sounds extremely unlikely.

- A determined user trying to deliberately destroy information? A lot of things are easier, e.g. `dd if=/dev/zero of=/dev/sda` to `shred important_document.pdf`.

The only thing that would protect against most accidental-destruction scenarios is not giving the users root access, and then you don't have to worry about users removing LUKS keys anyway.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#18

Post by majewsky » Mon, Mar 04, 2019, 9:20 AM UTC

Nux wrote: post #8

throwaway77384 wrote: post #4

Earlier quoted context omitted.

Ackchually, enabling full disk encryption via LUKS is rather easy on Manjaro. It's literally a button that states "use full disk encryption" as part of the setup wizard. You then enter a password and that's it. The tricky bit is if GRUB breaks (hint: GRUB looks for every opportunity to break. If it can break, it will) and you have to chroot into an encrypted LUKS partition. That's where your average user will be SOL.…

The parent was referring to doing it after the installation and he is right, it can't be done without serious hassle.

I can see why that's useful for Windows or MacOS, where most users get the OS preinstalled when purchasing the machine. But Linux is installed by the user themselves (or a trusted person) 99% of the time, so it's usually sufficient to set it up at install time.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#19

Post by dmm » Mon, Mar 04, 2019, 9:25 AM UTC

ergo14 wrote: post #11

wheelerwj wrote: post #7

Earlier quoted context omitted.

this. it was the easiest thing ever.

Only if you want to have a single partition :( If you want to have separate ones you have to do manual dance around luks. I'd wish it was easier to set up for multiple partitions.

Use a single partition as an lvm physical volume. Then you can have as many partitions in that as you want. This is what the Debian installer does by default if you select disk encryption.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#20

Post by [deleted] » Mon, Mar 04, 2019, 9:26 AM UTC

mrkeen wrote: post #16

jstanley wrote: post #14

Earlier quoted context omitted.

OP specifically stated: > I know you can do FDE with LUKS but would prefer a more enterprise solution where I can store a recovery key centrally that a user can’t remove.

OP may have stated LUKS, but the Ubuntu installer doesn't. https://i.stack.imgur.com/6Heoq.png

[deleted]