• 14 Posts
  • 88 Comments
Joined 1 year ago
cake
Cake day: July 15th, 2024

help-circle











  • arch linux was what forced me to use LUKS on all of my installs regardless of distros, btw.

    i used the standard layout:/boot, /, /home, swap. So when the installs break, the best way to fix is to use the archiso and remount and re arch-chroot.

    Well… i found out that without LUKS, anybody can use any distros live cd and mount my stuff.

    At first, I used LUKs only on the main partitions: so / and /home, or just / if no separate /home. Swap remains unencrypted. Boot is also unencrypted.

    You could encrypt those too but need more work and hackery stuff:

    • encrypted boot: can be slow if you boot the compututer from cold. There’s also this thing where you need to enter the password twice => think Fedora has an article to get around this. Iirc, it involves storing the boot’s encrypted password as a key deep within the root directory.

    • encrypted swap: the tricky thing is to use this with hibernation. I managed to get it to work once but with Zram stuff, I dont use hibernation anymore. It involved writing the correct arguments in the /boot/grub/grub.cfg. Basically tells the bootloader to hibernate and resume from hibernation with the correct UUID.