4 ms·
Ask HN: Cryptsetup Luks Security
Luks dmcrypt is unlocked at boot from initrd image and kernel that are not encrypted which means that they are vulnerable to manipulation for anyone that has physical access to the server, is this correct? How to mitigate?
- kosolam 3y agoFound: secureboot enabled will boot signed kernels
- kosolam 3y agoHere, this sums it all. I wonder what is the state today, 3 years later? https://0pointer.net/blog/authenticated-boot-and-disk-encryption-on-linux.html https://0pointer.net/blog/authenticated-boot-and-disk-encryp...
- kosolam 3y agoThe state today: https://lwn.net/Articles/946526/ https://lwn.net/Articles/946526/