Re: Using dm-crypt: whole disk encryption
Didier Spaier <[email protected]> Tue, 23 Mar 2021 00:50:04 +0100
| Newsgroups | gmane.linux.kernel.device-mapper.dm-crypt |
|---|---|
| Message-ID | <[email protected]> |
Le 22/03/2021 à 17:43, Johnny Dahlberg a écrit : > On Sun, 21 Mar 2021 at 17:20, ken <[email protected] > <mailto:[email protected]>> wrote: > > A new laptop is on the way and I'm considering using dm-crypt 2 > secure the whole SSD. I have some basic questions though. > > Is it possible to encrypt the entire Drive, including all the system > files? > Yes, you can do this extremely easily in distributions that support it. > What does "it" mean? Well, simply: Placing the kernel and bootloader on > an EFI /boot/efi partition and using that as a bootstrap to decrypt the > main partition. And auto-updating it every time the main system kernel > is updated. > I highly recommend my favorite Linux distro, which handles all of that > automatically and asks if you want Full Disk Encryption during install: > https://pop.system76.com/ Well Slint can do that as well in 'Auto' mode, with a simpler layout: 1. A BiosBoot partition # For GRUB to boot in Legacy mode 2. An ESP # Contains only the EFI OS loader 3. A partition for /, encrypted 4. Optionally an additional partition, encrypted No LVM, the LUKS passphrase is asked by GRUB before displaying its menu, then loads the kernel and the initrd, which includes a LUKS key used to unlock /, also stored in /etc/keys Another LUKS key stored in /etc/keys allows then to unlock /data. when the kernel is updated, the key used to unlock / is copied in the new initrd. As an aside, instead of a swap partition a small swap file is set up, as well as a swap space in zram with a higher priority. Out of curiosity I installed pop-os in a Qemu VM. I think it would be fair to mention on the website that it's based on Ubuntu. I don't like GNOME, but that's just a personal taste ;) Slint's website: https://slint.fr Main server: http://slackware.uk/slint/x86_64/slint-14.2.1/ Best regards, Didier _______________________________________________ dm-crypt mailing list -- [email protected] To unsubscribe send an email to [email protected]