3 ms·

Ackchually, enabling full disk encryption via LUKS is rather easy on Manjaro. It's literally a button that states "use full disk encryption" as part of the setu

Ackchually, enabling full disk encryption via LUKS is rather easy on Manjaro. It's literally a button that states "use full disk encryption" as part of the setup wizard. You then enter a password and that's it. The tricky bit is if GRUB breaks (hint: GRUB looks for every opportunity to break. If it can break, it will) and you have to chroot into an encrypted LUKS partition. That's where your average user will be SOL. Not sure how the recovery process would work for Bitlocker or FileVault.

Nux 8y ago
The parent was referring to doing it after the installation and he is right, it can't be done without serious hassle.
- majewsky 8y ago
  I can see why that's useful for Windows or MacOS, where most users get the OS preinstalled when purchasing the machine. But Linux is installed by the user themselves (or a trusted person) 99% of the time, so it's usually sufficient to set it up at install time.
  - chopin 8y ago
    For me, not so much. I installed Mint and skipped the step (as to not to introduce more complexity the first time), thinking 'I can do that later'. The disk is still unencrypted... Is there a way to do this and to restore the system state (installed software etc.)? DuckDuckGo didn't reveal anything conclusive. Could anybody comment on the convenience of Linux encryptions (eg. LUKS)? In Windows, encryption is totally transparent to users (I need only to type the account password). I wouldn't mind typing in two passwords, other users on the systems not so much.
    - glandium 8y ago
      I did it "manually" a while ago: https://glandium.org/blog/?p=139 https://glandium.org/blog/?p=139 https://glandium.org/blog/?p=141 https://glandium.org/blog/?p=141 There are more automated ways to do the conversion now. Here's the first one I found while searching for my own blog posts above: https://www.johannes-bauer.com/linux/luksipc/ https://www.johannes-bauer.com/linux/luksipc/
    - r3bl 8y ago
      You can encrypt /home/<user> relatively easily, but you can't avoid having to type in two passwords if you want FDE. You have to decrypt the hard drive to reach the login screen, and other users would have to do the same as well. You don't need to share any of those two passwords, since LUKS has up to 8 password slots I believe.
    - saint_abroad 8y ago
      > In Windows, encryption is totally transparent to users (I need only to type the account password). With transparent encryption, Windows decrypts the disk at boot using the TPM. Prior to login the disk is already mounted (decrypted). It provides an easy way for enterprise to say, "yes- we have FDE".
      - chopin 8y ago
        So there is no protection if the entire device is stolen (or put in a backroom at a border)? You can just boot it up and acess the disk without having a user? The Wikipedia page on Bitlocker does not mention this problem for TPM mode. Or is only a part decrypted until a user logs in? Edited to add: The best I could find was this discussion: https://www.reddit.com/r/sysadmin/comments/5fllep/whats_the_point_of_bitlocker_with_tpmonly_mode_as/ https://www.reddit.com/r/sysadmin/comments/5fllep/whats_the_...
- throwaway77384 8y ago
  Ah, having re-read the post, I still don't really get that from it, but that's probably just down to me missing the point regarding central management of keys. So, then, after installation, yes, I could see how that would be a nightmare. I have never attempted it!
Leace 8y ago
For modern setups that support UEFI, GRUB is unnecessary as you can boot Linux kernel directly as EFI executable. If one cares about SecureBoot then this package automates everything: https://github.com/andreyv/sbupdate https://github.com/andreyv/sbupdate (it's setup only once and works later without supervision).

Nux 8y ago

The parent was referring to doing it after the installation and he is right, it can't be done without serious hassle.

majewsky 8y ago
I can see why that's useful for Windows or MacOS, where most users get the OS preinstalled when purchasing the machine. But Linux is installed by the user themselves (or a trusted person) 99% of the time, so it's usually sufficient to set it up at install time.
- chopin 8y ago
  For me, not so much. I installed Mint and skipped the step (as to not to introduce more complexity the first time), thinking 'I can do that later'. The disk is still unencrypted... Is there a way to do this and to restore the system state (installed software etc.)? DuckDuckGo didn't reveal anything conclusive. Could anybody comment on the convenience of Linux encryptions (eg. LUKS)? In Windows, encryption is totally transparent to users (I need only to type the account password). I wouldn't mind typing in two passwords, other users on the systems not so much.
  - glandium 8y ago
    I did it "manually" a while ago: https://glandium.org/blog/?p=139 https://glandium.org/blog/?p=139 https://glandium.org/blog/?p=141 https://glandium.org/blog/?p=141 There are more automated ways to do the conversion now. Here's the first one I found while searching for my own blog posts above: https://www.johannes-bauer.com/linux/luksipc/ https://www.johannes-bauer.com/linux/luksipc/
  - r3bl 8y ago
    You can encrypt /home/<user> relatively easily, but you can't avoid having to type in two passwords if you want FDE. You have to decrypt the hard drive to reach the login screen, and other users would have to do the same as well. You don't need to share any of those two passwords, since LUKS has up to 8 password slots I believe.
  - saint_abroad 8y ago
    > In Windows, encryption is totally transparent to users (I need only to type the account password). With transparent encryption, Windows decrypts the disk at boot using the TPM. Prior to login the disk is already mounted (decrypted). It provides an easy way for enterprise to say, "yes- we have FDE".
    - chopin 8y ago
      So there is no protection if the entire device is stolen (or put in a backroom at a border)? You can just boot it up and acess the disk without having a user? The Wikipedia page on Bitlocker does not mention this problem for TPM mode. Or is only a part decrypted until a user logs in? Edited to add: The best I could find was this discussion: https://www.reddit.com/r/sysadmin/comments/5fllep/whats_the_point_of_bitlocker_with_tpmonly_mode_as/ https://www.reddit.com/r/sysadmin/comments/5fllep/whats_the_...
throwaway77384 8y ago
Ah, having re-read the post, I still don't really get that from it, but that's probably just down to me missing the point regarding central management of keys. So, then, after installation, yes, I could see how that would be a nightmare. I have never attempted it!

Leace 8y ago

For modern setups that support UEFI, GRUB is unnecessary as you can boot Linux kernel directly as EFI executable. If one cares about SecureBoot then this package automates everything: https://github.com/andreyv/sbupdate https://github.com/andreyv/sbupdate (it's setup only once and works later without supervision).