Good day, I am currently planning an environment where it comes down to the biggest security risk being to boot to another environment and tamper with the install on the disk (Older PCs with physical access to the box that are accessible to the public). Since BIOS passwords offer little deterrent and the PC's don't have TPM to best of my knowledge, what would you recommend to make the install tamper-proof? I am currently thinking full block device encryption (LUKS) that includes the /boot folder - should this be enough? This way even though you are able to boot up to another device the install disk shouldn't be a problem, correct? Thanks in advance
EDIT: Just to clarify, the PC's are under surveillance and in cabinets- so attaching a hardware keylogger won't easily go unnoticed. Booting to a USB and tampering with the install - this is the big problem. Advanced attacks like modification to the BIOS/UEFI firmware probably won't happen (school environment) - software keyloggers being the big worry.
EDIT2: Further clarification - the PC's are in a cabinet like so:
With the top part covered. The keyboards are plugged in at the back, so to access the keyboard USB you would have to remove the whole desktop from the cabinet. The surveillance is not constantly monitored but should a keylogger be found (or a security breach) it would be very easy to see where and when this happened (identification is not a problem since it is a school environment, as for calibre of attackers advanced attacks shouldn't be a problem, more likely is the casual keylogger and modifying install). Since the surveillance is not to the extent where activity on the screen can be monitored booting to another environment and working there can go easily unnoticed. The proposed environment is a Linux install running a non-persistent Windows VM - so an OS exploit shouldn't be a problem from inside Windows and the Linux install would be running a non-privileged user, so damage is limited to almost nothing. But, if the Linux installed can be tampered with before boot up all goes to hell. This is why I see preventing tampering with the Linux install as the biggest problem.