Hacker News Reader

Comment by Daniel_sk | Hacker News Reader

I wish it was so easy as on MacOS or Windows - where you can essentially turn it on with one button. I don't think enabling encryption on an existing installation of Linux can be done without reinstalling or a lot of work.

View on HN

Ackchually, enabling full disk encryption via LUKS is rather easy on Manjaro. It's literally a button that states "use full disk encryption" as part of the setup wizard. You then enter a password and that's it.

The tricky bit is if GRUB breaks (hint: GRUB looks for every opportunity to break. If it can break, it will) and you have to chroot into an encrypted LUKS partition. That's where your average user will be SOL. Not sure how the recovery process would work for Bitlocker or FileVault.

For modern setups that support UEFI, GRUB is unnecessary as you can boot Linux kernel directly as EFI executable.

If one cares about SecureBoot then this package automates everything: https://github.com/andreyv/sbupdate (it's setup only once and works later without supervision).

The parent was referring to doing it after the installation and he is right, it can't be done without serious hassle.

Ah, having re-read the post, I still don't really get that from it, but that's probably just down to me missing the point regarding central management of keys.

So, then, after installation, yes, I could see how that would be a nightmare. I have never attempted it!

I can see why that's useful for Windows or MacOS, where most users get the OS preinstalled when purchasing the machine. But Linux is installed by the user themselves (or a trusted person) 99% of the time, so it's usually sufficient to set it up at install time.

For me, not so much. I installed Mint and skipped the step (as to not to introduce more complexity the first time), thinking 'I can do that later'. The disk is still unencrypted... Is there a way to do this and to restore the system state (installed software etc.)? DuckDuckGo didn't reveal anything conclusive.

Could anybody comment on the convenience of Linux encryptions (eg. LUKS)? In Windows, encryption is totally transparent to users (I need only to type the account password). I wouldn't mind typing in two passwords, other users on the systems not so much.

I did it "manually" a while ago: https://glandium.org/blog/?p=139 https://glandium.org/blog/?p=141

There are more automated ways to do the conversion now. Here's the first one I found while searching for my own blog posts above: https://www.johannes-bauer.com/linux/luksipc/

> In Windows, encryption is totally transparent to users (I need only to type the account password).

With transparent encryption, Windows decrypts the disk at boot using the TPM. Prior to login the disk is already mounted (decrypted).

It provides an easy way for enterprise to say, "yes- we have FDE".

So there is no protection if the entire device is stolen (or put in a backroom at a border)? You can just boot it up and acess the disk without having a user? The Wikipedia page on Bitlocker does not mention this problem for TPM mode. Or is only a part decrypted until a user logs in?

Edited to add: The best I could find was this discussion: https://www.reddit.com/r/sysadmin/comments/5fllep/whats_the_...

You can encrypt /home/<user> relatively easily, but you can't avoid having to type in two passwords if you want FDE.

You have to decrypt the hard drive to reach the login screen, and other users would have to do the same as well. You don't need to share any of those two passwords, since LUKS has up to 8 password slots I believe.

on MacOS its pretty easy... i use it, i think? and Windows its relatively simple too since they added BitLocker in 10. i think every os supports it?

> and Windows its relatively simple too since they added BitLocker in 10.

Not really. OEM installs have it, but Windows 10 Home doesn't. If you're on an OEM install and decrypt the hard drive once, you won't be able to re-encrypt it without paying for a Pro upgrade. That mistake costs $100.

Reply on news.ycombinator.com