I encrypt my desktop and laptop but not my servers. On desktop, that excludes drives that aren't my OS/boot drive.
this post was submitted on 16 Jan 2025
176 points (98.9% liked)
Linux
56329 readers
781 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 6 years ago
MODERATORS
I encrypt my laptop and desktops and I think it’s worth it. I regret encrypting my servers because they need passwords to turn on. I couldn’t figure out how to handle it when away.
With initramfs and dropbear you can make the password prompt accessible over ssh, so you can enter the password from anywhere.
Edit: For debian it is something like
- install dropbear
- configure dropbear for initramfs
- generate key pair
- generate initramfs
- You are done.
Cryptab should help.
I tried it. Wonder if I was doing something dumb…
Did you get it working, if your boot is encrypted (I think) then I think you may have a hard time. Its been about 7 years since I did it. But you can have fstab and crypttab setup to pass the password.
That’s what I was trying to do. I think I encrypted everything as it was my second plain Linux server, not unraid or truenas. I didn’t get it working
Any tips?
Servers are harder and not preconfigued if you want unattended boot. The first key has to come from somewhere typically to unlock the root partition. The other keys can then be stored on that encrypted partition and are typically referenced by crypttab for auto unlock.
The first key can come from anywhere you want such as attached media like a flash drive, a over the network say via ssh, from a key server, or from the TPM. Or you could remotely connect to the console. There are bunch of how tos out there. It amounts to customizing the boot process and the initramfs. It is not simple. What makes sense depends on the threat model.
load more comments
(2 replies)
I encrypt my home folder and Windows install just in case someone breaks into my house and steals my computer. Super annoying entering my password each boot though.
Mostly I don't, but I want to start to. I only have one laptop encrypted and of course I keep my phones encrypted.
Yes absolutely, it is the building block of my security posture. I encrypt because I don’t want thieves to have access to my personal data, nor do I want law enforcement or the state to have access if they were to raid my house. I’m politically active and a dissident so I find it vital to keep my data secure and private, but frankly everybody should be doing it for their own protection and peace of mind
Absolutely. LUKS full disk encryption. Comes as an opt-in checkbox on Ubuntu, for example.
And I too cannot understand why this is not opt-out rather than opt-in. Apparently we've decided that only normies on corporate spyware OSs need security, and we don't.
load more comments
(18 replies)
No need as none of them are networked
Do you physically crush and grind your drives once they are end-of-life?
Depends. On external drives yes. On internal boot drive no. I had performance issues and thermal issues with it so stopped on boot drives.
I always encrypt my computer SSD as well as my external backup drive. I just wish that when installing a Linux distro and when selecting encryption that it would work with multiple drives
Yeah all my drives are encrypted with LUKS mostly because of home burglaries (bad area and whatnot). I still keep backups regardless on drives that are also encrypted
Only encrypt the home partition, for the root partition it just unnecessarily slows down the system.
Also, I think, there could be different approaches instead of encryption. AFAIK, android doesn't use encryption underneath, but uses a semi-closed bootloader (which means, if you install a different OS, all user data gets wiped). I'm currently investigating the feasibility of such an approach in the long term.
load more comments
(2 replies)