Linux
Welcome to c/linux!
Welcome to our thriving Linux community! Whether you're a seasoned Linux enthusiast or just starting your journey, we're excited to have you here. Explore, learn, and collaborate with like-minded individuals who share a passion for open-source software and the endless possibilities it offers. Together, let's dive into the world of Linux and embrace the power of freedom, customization, and innovation. Enjoy your stay and feel free to join the vibrant discussions that await you!
Rules:
-
Stay on topic: Posts and discussions should be related to Linux, open source software, and related technologies.
-
Be respectful: Treat fellow community members with respect and courtesy.
-
Quality over quantity: Share informative and thought-provoking content.
-
No spam or self-promotion: Avoid excessive self-promotion or spamming.
-
No NSFW adult content
-
Follow general lemmy guidelines.
view the rest of the comments
This is an issue I run into running a headless Linux computer as well. On macOS I’m never running headless, so never ran into this issue. But needing to enter a password before the OS boots is a decision that makes Linux kind of awkward to use disk encryption with.
And I’m almost certainly doing it wrong, so would appreciate being nudged in the right direction.
I’ve seen a post about storing the encryption keys in TPM, but others say then you can lose your keys if the mobo dies. I’ve heard you can use ssh keys, but I’m not sure how — and here that would require a second device to unlock your tablet.
macOS uses a read only OS partition to boot and then encrypts your user data partition, can I do that with Linux?
TPM2 + Secure Boot via
systemd-cryptenrollis the closest to the "just works" FileVault/Android experience. Keep a recovery passphrase in your password manager. You don't lose your data if the motherboard dies, you just use the recovery key.I use this on my daily drive laptop. Only real hiccup is that I still keep the dual boot because fwupd does not cover my laptop BIOS firmware updates but in a Linux tablet this a no issue.
Why not use LUKS? Hibernate to partition (even LVM) works, all native, and full disk support.
LUKS isn’t the alternative here, it’s the baseline. The question is how to unlock LUKS without manual passphrase entry at boot.
Using TPM2 + Secure Boot (e.g. via systemd-cryptenroll) binds the LUKS key to platform integrity, so it auto-unlocks when the system hasn’t been tampered with. You still keep a recovery passphrase, so you’re not locked out if hardware changes or fails.
But then anyone can just walk up to the machine and turn it on and have it be decrypted. Am I missing something?
TPM auto-unlock still relies on measured boot integrity (Secure Boot/PCRs), so it protects against offline theft and tampering when the machine is off or storage is removed.
But if an attacker has repeated physical access during boot, the protection depends on whether you’ve added extra factors like a TPM PIN or pre-boot passphrase. Login prompts don’t re-protect the disk once it’s decrypted.
In practice, for my use case (mostly shutdown or battery-dead scenarios), this is an acceptable trade-off for convenience. If your threat model includes targeted physical access during boot, then keeping a pre-boot secret is still the safer choice.
Ahh so the pin or passphrase would basically give the same protection. Thanks.