Is it sufficient to put /var, /tmp/, and /home on their own encrypted partitions?

Question

I want to encrypt my system, but I don't want the hassle of having to put in two passwords on boot; I just want to put in one password on login that would decrypt the other partitions. I have heard that just encrypting /home is not wise, and that /tmp, and /var contain sensitive data as well, so I figured it might be a good idea to just put them on their own encrypted partitions as well. Would it be better to just encrypt the full drive?

Answer 1

Sensitive data can live in lots of places. For example, /etc will contain system configuration data that might be sensitive (for example, any custom /etc/hosts entries might tell people about your network). /root might contain data like private keys or secrets in .bash_history. Maybe your webroot, with server-side source code and/or TLS private keys, is under /srv instead of /var or /home. Obviously, you know your own system best, but even you might not realize where everything is.

In general you want full-volume encryption if you can get it, yeah.

With that said, there are a few options for the number of passwords you have to put in. If you encrypt the volume where the kernel is stored, the bootloader will ask you for a password, and then the OS will ask you again; if you don't, you can skip one of those prompts. If you have a TPM, some disk encryption utilities can use it for passwordless decryption in the case that the boot process hasn't been tampered with, though I'm not sure if any Linux utilities specifically support this (and it does introduce some additional risk in the face of sophisticated attackers). MacOS FileVault encryption can prompt for a password only once and then use that password both to decrypt the drive and log you in, but again I don't know of a Linux equivalent.

Finally, most disk encryption tools - certainly any that don't use the TPM - are at risk of an "evil maid" attack, where whatever is not encrypted - be it just the bootloader, the kernel, or most of the system - is replaced with a malicious version that steals the password and/or volume decryption key. This of course relies on you using the device after the attacker tampered with it, which isn't the usual risk scenario of simple loss or theft, but is something you might consider if you're worried about taking the device anywhere with sophisticated attackers, or are a sufficiently high-profile target for them to come after you.