Ask HN: What Do You Use for Linux Full Disk Crypto? • Hacker News Board

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#21

Post by throwaway77384 » Mon, Mar 04, 2019, 9:27 AM UTC

Nux wrote: post #8

throwaway77384 wrote: post #4

Earlier quoted context omitted.

Ackchually, enabling full disk encryption via LUKS is rather easy on Manjaro. It's literally a button that states "use full disk encryption" as part of the setup wizard. You then enter a password and that's it. The tricky bit is if GRUB breaks (hint: GRUB looks for every opportunity to break. If it can break, it will) and you have to chroot into an encrypted LUKS partition. That's where your average user will be SOL.…

The parent was referring to doing it after the installation and he is right, it can't be done without serious hassle.

Ah, having re-read the post, I still don't really get that from it, but that's probably just down to me missing the point regarding central management of keys.

So, then, after installation, yes, I could see how that would be a nightmare. I have never attempted it!

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#22

Post by jstanley » Mon, Mar 04, 2019, 9:28 AM UTC

In the past I have used LUKS and simply stored a copy of the passphrase centrally. Not very "enterprise" though.

A user who wants to destroy data can do so regardless. Storing a key centrally only guards against accidental loss of the key.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#23

Post by gpetrosyan » Mon, Mar 04, 2019, 9:32 AM UTC

This article gives a good overview of the options and potential threats: https://www.whonix.org/wiki/Full_Disk_Encryption_and_Encrypt...

Use whonix itself and read the privacy guides in its wiki if you are concerned with privacy beyond FDE.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#24

Post by 8fingerlouie » Mon, Mar 04, 2019, 9:41 AM UTC

I'm using LUKS, with disks being mounted with crypttab.

The keys for the drives are stored on an encrypted USB key, and the key for the encrypted USB key is stored on the root SSD.

I wanted something where i could boot unattended, and at the same time i wanted the possibility to destroy the keys and render the disks useless.

I have an encrypted backup of the keys, stored outside of the encrypted disk arrays.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#25

Post by 8fingerlouie » Mon, Mar 04, 2019, 9:44 AM UTC

rwmj wrote: post #2

LUKS + Clevis and Tang does all that you want. http://www.admin-magazine.com/Archive/2018/43/Automatic-data... There's no way to prevent a determined user with root access from removing a key, except maybe some kind of locked down trusted boot scenario which will undoubtedly create more problems than it solves.

FDE doesn't protect in case someone breaks in.

Its purpose is to protect data at rest, and if you keep it available in its unencrypted form, you're not gaining anything from it.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#26

Post by xorcist » Mon, Mar 04, 2019, 10:00 AM UTC

LUKS can use a central recovery key.

Regular users can't mess with LUKS settings.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#27

Post by chopin » Mon, Mar 04, 2019, 10:14 AM UTC

majewsky wrote: post #18

Nux wrote: post #8

Earlier quoted context omitted.

The parent was referring to doing it after the installation and he is right, it can't be done without serious hassle.

I can see why that's useful for Windows or MacOS, where most users get the OS preinstalled when purchasing the machine. But Linux is installed by the user themselves (or a trusted person) 99% of the time, so it's usually sufficient to set it up at install time.

For me, not so much. I installed Mint and skipped the step (as to not to introduce more complexity the first time), thinking 'I can do that later'. The disk is still unencrypted... Is there a way to do this and to restore the system state (installed software etc.)? DuckDuckGo didn't reveal anything conclusive.

Could anybody comment on the convenience of Linux encryptions (eg. LUKS)? In Windows, encryption is totally transparent to users (I need only to type the account password). I wouldn't mind typing in two passwords, other users on the systems not so much.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#28

Post by glandium » Mon, Mar 04, 2019, 10:24 AM UTC

chopin wrote: post #27

majewsky wrote: post #18

Earlier quoted context omitted.

I can see why that's useful for Windows or MacOS, where most users get the OS preinstalled when purchasing the machine. But Linux is installed by the user themselves (or a trusted person) 99% of the time, so it's usually sufficient to set it up at install time.

For me, not so much. I installed Mint and skipped the step (as to not to introduce more complexity the first time), thinking 'I can do that later'. The disk is still unencrypted... Is there a way to do this and to restore the system state (installed software etc.)? DuckDuckGo didn't reveal anything conclusive. Could anybody comment on the convenience of Linux encryptions (eg. LUKS)? In Windows, encryption is totally…

I did it "manually" a while ago: https://glandium.org/blog/?p=139 https://glandium.org/blog/?p=141

There are more automated ways to do the conversion now. Here's the first one I found while searching for my own blog posts above: https://www.johannes-bauer.com/linux/luksipc/

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#29

Post by r3bl » Mon, Mar 04, 2019, 10:26 AM UTC

chopin wrote: post #27

majewsky wrote: post #18

Earlier quoted context omitted.

I can see why that's useful for Windows or MacOS, where most users get the OS preinstalled when purchasing the machine. But Linux is installed by the user themselves (or a trusted person) 99% of the time, so it's usually sufficient to set it up at install time.

For me, not so much. I installed Mint and skipped the step (as to not to introduce more complexity the first time), thinking 'I can do that later'. The disk is still unencrypted... Is there a way to do this and to restore the system state (installed software etc.)? DuckDuckGo didn't reveal anything conclusive. Could anybody comment on the convenience of Linux encryptions (eg. LUKS)? In Windows, encryption is totally…

You can encrypt /home/ relatively easily, but you can't avoid having to type in two passwords if you want FDE.

You have to decrypt the hard drive to reach the login screen, and other users would have to do the same as well. You don't need to share any of those two passwords, since LUKS has up to 8 password slots I believe.

Re: Ask HN: What Do You Use for Linux Full Disk Crypto?

#30

Post by saint_abroad » Mon, Mar 04, 2019, 10:28 AM UTC

chopin wrote: post #27

majewsky wrote: post #18

Earlier quoted context omitted.

I can see why that's useful for Windows or MacOS, where most users get the OS preinstalled when purchasing the machine. But Linux is installed by the user themselves (or a trusted person) 99% of the time, so it's usually sufficient to set it up at install time.

For me, not so much. I installed Mint and skipped the step (as to not to introduce more complexity the first time), thinking 'I can do that later'. The disk is still unencrypted... Is there a way to do this and to restore the system state (installed software etc.)? DuckDuckGo didn't reveal anything conclusive. Could anybody comment on the convenience of Linux encryptions (eg. LUKS)? In Windows, encryption is totally…

> In Windows, encryption is totally transparent to users (I need only to type the account password).

With transparent encryption, Windows decrypts the disk at boot using the TPM. Prior to login the disk is already mounted (decrypted).

It provides an easy way for enterprise to say, "yes- we have FDE".