Hacker News Reader

Comment by fyfy18 | Hacker News Reader

What I’d really love is Linux to be able to unlock a fully encrypted root partition similar to macOS. On macOS the user is prompted to login at a very early stage of the boot process, and after this the disk is decrypted and the OS is booted. The user is then logged in automatically, so they only need to enter their password once to decrypt the disk and authenticate their account.

View on HN

It's definitely possible to configure this... it's just not a default on any distro I'm aware of. Linux Full Disk Encryption definitely stops very early and asks for the FDE password before being able to continue booting. After that, you would just have to have your user set to "automatically log in" for it to just go all the way in.

In fact, I think you could choose to set it up this way from the Ubuntu installer directly. By default, it just encourages you to sign in manually in addition to setting up FDE.

Actually I have my desktop configured with an encrypted root. Turns out GRUB can actually decrypt the partition holding /boot before loading the grub.cfg. Though I have this set up on ArchLinux and had to refer to the Arch wiki a lot to get this set up properly. Definitely not that user friendly, but I can say it is a possible setup after having used it for years on my desktop now.

EDIT: To clarify, my setup requires inputting passwords twice: once for decrypting the root partition, and once to login after everything has booted. During the boot process the system needs to remount everything, so I had the encrypted partition(s) also be decrypted with a key file (typically `dd if=/dev/urandom of=keyfile bs=1M count=4`; LUKS encryption can have multiple keyfiles/passwords to decrypt) and had the key file(s) put in the initramfs so after GRUB has decrypted root and loaded /boot/grub.cfg, the booted system could decrypt and mount everything needed with the key file(s).

I have a similar setup for my Arch install. I also put my swap into the encrypted LVM partition. Nothing is on the disk unencrypted. I also had to refer to the Arch wiki a lot, and it took me 2 attempts to get it right.

Linux does that too. It asks for the encryption password very early in the boot sequence and that is it.

That's my setup since some years. It's one of the options during Fedora's installation, I think that Ubuntu allows that too (and likely others).

Reply on news.ycombinator.com