this post was submitted on 07 Jul 2023
23 points (96.0% liked)

Linux

47299 readers
519 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
AgreeableLandscape@lemmy.ml
nooter692@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
d3Xt3r@lemmy.nz
23
Debian 12: How to setup disk encryption with TPM2 (lemmy.world)
submitted 1 year ago by TCB13@lemmy.world to c/linux@lemmy.ml
14 comments fedilink hide all child comments
 

Hello,

I've an HP EliteBook 840 G5 that I've been using up until now with Windows 10. I want to replace it with Debian 12 however since this is a laptop I would like to have my disk fully encrypted as well as the boot stage (initramfs etc).

My threat model: make sure if someone stoles the laptop, powered off, they won't be able to access my data. I would also like to avoid evil maid attacks and make sure I'm not booting into some modified kernel / system with spyware or that will leak my TPM keys.

I've found some information online but I'm unsure of how secure those setups are and/or if it isn't even possible to have the same level of security that Windows provides.

Here are a few of my questions:

  • Anyone around here that has a similar HP laptop and did this?
  • What about enrolling secure boot keys on the UEFI? From what I read simply using the typical Linux shim makes things more secure but it doesn't fix the problem. Enrolling keys seems to break some motherboards
  • Even if I use --tpm2-pcrs=1,4,5,7,9 how secure is that, should I add more?
  • What is the impact of this in system upgrades? How do I deal with those?
  • If I want to proceed with this what I should know / what typically fails or can be problematic / security issue?

Some of the information I found:

Thank you.

you are viewing a single comment's thread
view the rest of the comments
[–] TCB13@lemmy.world 1 points 1 year ago

Yes, there are but they mostly assume the use of the SHIM. That was the reason why I posted this.