1

It is said that one cannot simply encrypt their home directory/partition because the system will often store sensitive data elsewhere in the system which would not be encrypted. This makes me wonder if one could simply also encrypt these other sensitive directories. Which directories would these be? I would assume /var, and /tmp. All that would then have to happen is the user would mount and unlock those directories at login. Or would this cause issues for the system? Do these directories need to be available at boot?

2
  • 1
    Is your goal "prevent somebody who steals your device from pulling personal files off of it", "prevent somebody who steals your device from pulling any kind of sensitive data off of it", or "prevent somebody who has temporary unmonitored access to your device from introducing malware"? Because those all call for different approaches.
    – CBHacking
    May 17, 2023 at 4:16
  • 1
    What is your threat model?
    – forest
    May 17, 2023 at 6:51

1 Answer 1

1

Keep it simple: encrypt everything except /boot. That's what Linux distributions do if you request an encrypted installation. The /boot partition stores the bootloader, the kernel, and a small filesystem which is temporarily loaded into RAM containing the necessarily tools to mount the encrypted partition(s).

On modern computers with hardware acceleration, the overhead of encryption is very small. (Use AES-128 to benefit from the acceleration, of course, don't try to get fancy with ciphers. I'm not sure what the best choice is if you don't have hardware acceleration for AES.)

You'll get a prompt for the encryption password during boot, not at login. Encrypting only one user's files is not really practical because one user's files can end up in shared directories.

If you really want per-user per-file encryption (which has historically not been very well supported under Linux), encrypt the swap with a random key that's generated in memory at boot time, and make sure that /tmp is on a tmpfs filesystem. That takes care of the main shared area where user data will unavoidably end up. Users then have to be careful not to put any confidential data in other areas which can't be encrypted with per-user credentials, such as:

  • local email under /var/mail or /var/spool/mail;
  • files being printed under /var/spool/cups;
  • credentials directly in a cron job script (ok, so don't do that) under /var/spool/cron;
  • wifi passwords that may be stored under /etc/NetworkManager/system-connections or similar;
  • etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .