this post was submitted on 16 Jan 2025
168 points (98.3% liked)

Linux

49071 readers
248 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
 

I was recently intrigued to learn that only half of the respondents to a survey said that they used disk encryption. Android, iOS, macOS, and Windows have been increasingly using encryption by default. On the other hand, while most Linux installers I've encountered include the option to encrypt, it is not selected by default.

Whether it's a test bench, beater laptop, NAS, or daily driver, I encrypt for peace of mind. Whatever I end up doing on my machines, I can be pretty confident my data won't end up in the wrong hands if the drive is stolen or lost and can be erased by simply overwriting the LUKS header. Recovering from an unbootable state or copying files out from an encrypted boot drive only takes a couple more commands compared to an unencrypted setup.

But that's just me and I'm curious to hear what other reasons to encrypt or not to encrypt are out there.

(page 4) 50 comments
sorted by: hot top controversial new old
[–] fmstrat@lemmy.nowsci.com 4 points 2 days ago

Yes, and for the life of me I don't understand why there isn't a default LUKS with hibernate partition in the Debian installer.

[–] ocean@lemmy.selfhostcat.com 3 points 2 days ago

I encrypt my laptop and desktops and I think it’s worth it. I regret encrypting my servers because they need passwords to turn on.

[–] BlackEco@lemmy.blackeco.com 4 points 2 days ago* (last edited 2 days ago)

I encrypted my professional laptop's drive in order to prevent access to company data and code in case of theft. And I'll probably encrypt my personal laptop as well because the SSH key can access company code.

As for the desktop, I didn't and probably never will, because theft is less likely and that would be a pain to handle for nightly backups (it is turned on with Wake-on-LAN and then a cron backs up my home directory to my NAS).

Finally, I won't encrypt my NAS as well for the same reason: it would quickly become a hassle as I would have to manually decrypt the drives every time it boots after a power outage.

[–] naeap@sopuli.xyz 4 points 2 days ago* (last edited 2 days ago) (1 children)

Yeah, on my laptop - because I travel with it and confidential data (like from my customers) could land in hands its not supposed to

No, in case of my desktop, because it's easier to access it in case of failure

[–] hallettj@leminal.space 2 points 2 days ago

My thinking is similar. I've seen this news story more than once:

laptop stolen containing customer data... hard drive was not encrypted

I don't generally have customer data, but it can happen every once in a while.

[–] 9488fcea02a9@sh.itjust.works 1 points 2 days ago

All my important files are on a NAS, so if someone steals my laptop, there's nothing of value there without being able to log in and mount the remote file systems

[–] Zorsith@lemmy.blahaj.zone 2 points 2 days ago

Of course, I'm paranoid and don't trust the US government. Or any government really. "First they came for _____" and all that; Id rather just tell them to pound sand immediately instead of get caught with my pants down.

[–] pemptago@lemmy.ml 3 points 2 days ago (1 children)

Yes. I encrypt because theft. I know PopOS and Mint make it 1-click ez. ...unless of course you want home and root on a separate drives. That scales difficulty real fast. There's plenty of tutorials, and I managed, but I had to patch together different ones to get a basic setup-- Never mind understanding exactly what I did and repeating it (the latest challenge I've been dragging my feet on). I do hope this is an area that sees more development in the near future.

[–] Jesus_666@lemmy.world 3 points 2 days ago

That does make encryption was less appealing to me. On one of my machines / and /home are on different drives and parts of ~ are on yet another one.

I consider the ability to mount file systems in random folders or to replace directories with symlinks at will to be absolutely core features of unixoid systems. If the current encryption toolset can't easily facilitate that then it's not quite RTM for my use case.

[–] gandalf_der_12te@discuss.tchncs.de 1 points 2 days ago (2 children)

Only encrypt the home partition, for the root partition it just unnecessarily slows down the system.

Also, I think, there could be different approaches instead of encryption. AFAIK, android doesn't use encryption underneath, but uses a semi-closed bootloader (which means, if you install a different OS, all user data gets wiped). I'm currently investigating the feasibility of such an approach in the long term.

load more comments (2 replies)
[–] 30p87@feddit.org 3 points 2 days ago

Doesn't Pop have that by default? I think others have too.

Anyway, yes for basically everything. Except my servers main partition, because otherwise recovering from crashes would be horribly annoying or unsafe if I'd use cryptssh. And if the dns+dhcp/gateway/VPN server crashes I'd definitely need 22 open.

[–] ilickfrogs@lemmy.world 2 points 2 days ago

I encrypt my desktop and laptop but not my servers. On desktop, that excludes drives that aren't my OS/boot drive.

[–] ocean@lemmy.selfhostcat.com 2 points 2 days ago (8 children)

I encrypt my laptop and desktops and I think it’s worth it. I regret encrypting my servers because they need passwords to turn on. I couldn’t figure out how to handle it when away.

[–] data1701d@startrek.website 3 points 2 days ago (1 children)

Do your servers have TPM? Clevis might be the way to go; I use it on my Thinkpad and it makes my life easy. If the servers don’t have TPM, Clevis also supports this weird thing called Tang, which from what I can tell basically assures that the servers can only be automatically decrypted on your local network. If Clevis fails, you can have it fall back to letting you enter the LVM password.

[–] ocean@lemmy.selfhostcat.com 2 points 2 days ago

I have not tried any of those three things: TPM, Clevis, or Tang. Thanks for recommending.

I tried to setup a keyfile on /, /boot, and /root.

I tried a keyfile on a usb

I also tried to use dropbear to allow ssh unlock.

Sadly these didn’t work and drove me crazy for two nights.

load more comments (7 replies)
[–] data1701d@startrek.website 2 points 2 days ago

I don't do it for my desktop because 1) I highly doubt my desktop would get stolen. 2) I installed Linux before I was aware of encryption, and don't have any desire to do a reinstall on my desktop at this time.

For my laptop, yes, I do (with exception of the boot partition), since it would be trivial to steal and this is a more recent install. I use clevis to auto-unlock the drive by getting keys from the TPM. I need to better protect myself against evil maids, though - luckily according to the Arch Wiki Clevis supports PCR registers.

[–] Extrasvhx9he@lemmy.today 1 points 2 days ago

Yeah all my drives are encrypted with LUKS mostly because of home burglaries (bad area and whatnot). I still keep backups regardless on drives that are also encrypted

[–] Laitinlok@lemmy.laitinlok.com 2 points 2 days ago

Yes because my distro also have encrypted /boot included

Mostly I don't, but I want to start to. I only have one laptop encrypted and of course I keep my phones encrypted.

load more comments
view more: ‹ prev next ›