I am looking for a security-centered Linux OS that allows you to take the /boot partition on a thumb-drive to alleviate concerns of an Evil Maid Attacks! What OS is it easy to remove the /boot partition and carry on a thumb-drive? How would you go about removing the /boot partition, and automatically mounting the thumb-drive so the computer will boot?
Preparing a USB flash drive to store
/boot/. So, then you will specify your BIOS to boot from the USB drive to access the GRUB bootloader and the Linux kernel, instead of the storage drive where the OS is installed.
(1) Prepare your usb flash boot-device under existing Debian installation using package gnome-disk-utility the following way (which is not necessarily the only way but tested and works for me).
(1.1) Format device with
(1.2) Create single
ext2partition making it occupy all available space.
(1.3) After step 1.2 completes go to "Edit partition" and set the bootable flag.
(2) Install Debian using its standard installer.
(2.1) Boot your installation media, i.e. Debian installation cd/dvd or another usb stick with .iso image written on it.
(2.2) Choose country/language, setup users and passwords, answer all the routine questions (no interest here) till disk partition dialog.
(2.3) Select manual partitioning.
(2.4) Create your raid/lvm/encrypted volumes on your main disk drive. On top of it there will be a file system, probably ext4.
(2.5) Go to properties of this file system and select mount as
/and "done with this partition".
(2.7) Find the usb stick in the list, it should have ext2 on it.
(2.8) Go to its properties and select mount as
noatimein additional flags. There is an option of formatting the partiton, DO NOT do it! "Keep the files".
(2.9) Select "Done with this partition".
(2.10) Select "Finish partitioning" or similar, installation process should continue with some dialogs that are straightforward.
(2.11) After a few other dialog that are straightforward and not of our interest here, there will be a dialog with a question where to install GRUB, which you should agree to install in your
Xis your usb boot flash.
The key part is LUKS cannot encrypt
/boot/. So, this is vulnerable to modification. Instead, we will move the
/boot/ partition onto another storage device, particularly a USB flash drive due to portability and boot from it to then load and decrypt the OS. However, this USB drive is still unencrypted and vulnerable to unauthorised modifications.