Why should one bother encrypting the harddisk in linux if one can easily recover the root password?

Question

If you have physical access to a machine, it's pretty straightforward to recover the root password thereby skipping the whole point of having an encrypted drive.

Am I missing something here?

EDIT: It seems that I was mistaken in a fundamental concept of disk encryption. The password for disk / directory encryption is separate from that of the system account passwords.

In the case of Full disk encryption, access to any system password needs to first go through the encryption password.

In the case where only the home directory is encrypted, the user login password is used along with the encryption password to create phrase which is used to encrypt and decrypt the home directory. A forced change of the user password (from a root account for e.g) will not update this encryption phrase and thus the data will remain secure.

Answer 1

If I was having a conversation with someone about this subject, I'd restate your question as this statement:

If you have physical access to a machine, it's pretty straightforward to bypass or reset the root password, which is the whole point of having an encrypted drive.

The idea being that you can very easily reboot into single-user / maintenance mood and get a root shell without a password. Then, as root, you can do just about anything you want, including overwriting the root password and rebooting with your new password, or just reading all the data straight from the disk.

Or, of course, just pulling the hard drive out and using another computer to copy all the data off of it or make changes to any of the data.

The way to prevent that sort of access is to encrypt the full drive, so an attacker would need to decrypt the drive before getting that root shell or seeing any of the files. In the context of your question, the root password is encrypted at rest so no one can change it or even see the hash until they've first decrypted the drive.

It's also important to separate full-disk encryption from an encrypted home directory. In the latter scheme, none of the system directories are encrypted so you can still boot into a maintenance shell and access all the system files, but the user's files would still be encrypted (hopefully with a separate passphrase!) that you'd need to crack in order to access those files.

Answer 2

If you have physical access to a machine, it's pretty straightforward to recover the root password thereby skipping the whole point of having an encrypted drive.

You might be mixing things up here. Root passwords and full-disk encryption passwords are not the same thing. At least they shouldn't be.

• Root passwords are what you use to log in as root/admin on your operating system.
• Full disk encryption is the password used to decrypt the hard-drive so you can even use it.

If someone has physical access to your device, and they don't have your disk encryption password, they cannot unlock the hard drive, and can't get any usable data from it. It'll be garbage.

Even if someone has your root password, they should not have your FDE password, unless you're using the same password for each, which in case, you have an incorrect security setup.

Answer 3

As others have pointed out, being able to change the root password (or any users account password) will not decrypt the disk. However, if full disk encryption is not used, then an attacker can perform an "evil maid" attack like this:

1. Make a full copy of the disk.
2. Boot into the system as root, using a rescue disk or maintenance shell.
3. Modify/trojan the disk encryption software to capture the encryption password and/or keys.
4. Post the credentials to an attacker owned server or stash them on disk somewhere for later collection.
5. Use the captured credentials and the previous disk copy to decrypt and read the data.

Technically an evil maid attack doesn't involve step 1, and involves coming back later to recover the captured credentials and possibly modify encrypted data.

Even if full disk encryption is used, people often don't encrypt the kernel or initial ramdisk. If they do encrypt those, then they often don't encrypt the bootloader, so it can similarly be trojaned with physical access. The bottom line is that somewhere there will be unencrypted code that reads the credentials before decrypting the rest of the disk. To protect against that, the unencrypted bootloader, etc. needs to be stored off the computer, eg. on a flash drive that the owner carries with them. Even this doesn't protect against a hardware keylogger or trojaned BIOS.

Having said all that, disk encryption does protect your data in the case where someone just steals your disk/computer, you send your disk in for warranty, or you sell/give away the disk and forget to zero it. These are the more common risks for most users.