I was recently intrigued to learn that only half of the respondents to a survey said that they used disk encryption. Android, iOS, macOS, and Windows have been increasingly using encryption by default. On the other hand, while most Linux installers I’ve encountered include the option to encrypt, it is not selected by default.

Whether it’s a test bench, beater laptop, NAS, or daily driver, I encrypt for peace of mind. Whatever I end up doing on my machines, I can be pretty confident my data won’t end up in the wrong hands if the drive is stolen or lost and can be erased by simply overwriting the LUKS header. Recovering from an unbootable state or copying files out from an encrypted boot drive only takes a couple more commands compared to an unencrypted setup.

But that’s just me and I’m curious to hear what other reasons to encrypt or not to encrypt are out there.

  • ocean@lemmy.selfhostcat.comEnglish
    2·
    1 day ago

    I encrypt my laptop and desktops and I think it’s worth it. I regret encrypting my servers because they need passwords to turn on. I couldn’t figure out how to handle it when away.

    • ShortN0te@lemmy.ml
      2·
      20 hours ago

      With initramfs and dropbear you can make the password prompt accessible over ssh, so you can enter the password from anywhere.

      Edit: For debian it is something like

      • install dropbear
      • configure dropbear for initramfs
      • generate key pair
      • generate initramfs
      • You are done.
    • data1701d (He/Him)@startrek.websiteEnglish
      3·
      1 day ago

      Do your servers have TPM? Clevis might be the way to go; I use it on my Thinkpad and it makes my life easy. If the servers don’t have TPM, Clevis also supports this weird thing called Tang, which from what I can tell basically assures that the servers can only be automatically decrypted on your local network. If Clevis fails, you can have it fall back to letting you enter the LVM password.

      • ocean@lemmy.selfhostcat.comEnglish
        2·
        1 day ago

        I have not tried any of those three things: TPM, Clevis, or Tang. Thanks for recommending.

        I tried to setup a keyfile on /, /boot, and /root.

        I tried a keyfile on a usb

        I also tried to use dropbear to allow ssh unlock.

        Sadly these didn’t work and drove me crazy for two nights.

        • flatbield@beehaw.orgEnglish
          2·
          22 hours ago

          Servers are harder and not preconfigued if you want unattended boot. The first key has to come from somewhere typically to unlock the root partition. The other keys can then be stored on that encrypted partition and are typically referenced by crypttab for auto unlock.

          The first key can come from anywhere you want such as attached media like a flash drive, a over the network say via ssh, from a key server, or from the TPM. Or you could remotely connect to the console. There are bunch of how tos out there. It amounts to customizing the boot process and the initramfs. It is not simple. What makes sense depends on the threat model.

        • BCsven@lemmy.ca
          1·
          1 day ago

          Did you get it working, if your boot is encrypted (I think) then I think you may have a hard time. Its been about 7 years since I did it. But you can have fstab and crypttab setup to pass the password.

          • ocean@lemmy.selfhostcat.comEnglish
            1·
            1 day ago

            That’s what I was trying to do. I think I encrypted everything as it was my second plain Linux server, not unraid or truenas. I didn’t get it working