6

I use full disk encryption on Linux and wonder whether there is any security risk ob having automatic login on the Linux itself. In case somebody breaks the encryption of the drive, they can read all the data directly, they would not have to log in to my Linux user account on the machine.

So is there any reason I should not use automatic login (into KDE) on a machine with FDE?

Improve this question
4
  • 2
    I'm unsure what you're asking. Are you asking can you have an automatic login of an account, or an automatic login for the disk encryption?
    – RoraΖ
    Oct 21, 2014 at 11:25
  • I clarified the question a bit. The automatic login is into Linux after it has booted from the encrypted disk. My rationale is that I already entered the long passphrase for the FDE, so it could log me in without me typing my login password again as well. I do have a user password though, to protect the computer when it is running, so that nobody can access it via SSH for instance.
    – Martin Ueding
    Oct 21, 2014 at 12:16
  • 1
    If someone had your FDE password, then they would have full access to your system.
    – RoraΖ
    Oct 21, 2014 at 12:27
  • I think the only major issue would be auto-login implies no screen lock ... such that if you don't power down when you walk away you have basically no protection at all.
    – CaffeineAddiction
    Oct 13 at 17:30

3 Answers 3

Reset to default
7

No risk at all. A login prompt is only for preventing physical access to the computer. This protection role has been replaced by the FDE and the accompanying PBA (which is much more secure), so any attacker that would break or somehow bypass the FDE could bypass your OS login too.

However, running as a limited user (with autologin on) and having a password-protected administrative account (with autologin off) can be useful, since the account then protects against online-based attacks (virus infections, malicious scripts etc) while the FDE protects against physical (offline-based) attacks.

But remember that anything that your currently logged on account has access to (regardless of password protection), can be accessed by a virus or malicious tool too, so a good idea here could be to also put sensitive data in separate encrypted containers with different passwords. So if you get a infection or a malicious script, then they only get access to whatever you are working with at the moment.

This would mean those containers would be encrypted 2 times on the disk platter, first by FDE and second by the container encryption.

Improve this answer
3
  • Agreed, though it is encrypted first by the container, and secondly by FDE.
    – Desthro
    Oct 21, 2014 at 15:13
  • 1
    I would highlight that the auto login account should be low-privileged user account. Auto login of an administrator would have significant risk.
    – RoraΖ
    Oct 21, 2014 at 16:02
  • Another thing to Point out is that it can be good to use different passwords for the admin account and the FDE, since the FDE password (Pre-boot auth) may be stored in RAM and thus accessible by a attacker on the low priv account. However, its not a significant security risk that a online attacker gains the FDE password since it would require physical access to the computer to be useful. And about the low privilege account - that was EXACTLY what I pointed out about online attacks.
    – sebastian nielsen
    Oct 21, 2014 at 18:12
1

Yes, with new TPM-backed FDE technologies like those used in mobile phones or Ubuntu Desktop, starting from 23.10, this would not be secure anymore.

The TPM-backed FDE is only aimed at protecting the boot stage but cannot prevent an attacker from logging into your machine if your computer gets stolen and you have enabled automatic login. In this case no passphrase is requested to unlock the disk as the secret is retrieved automatically from the TPM. If your login is automatic, there is nothing preventing the attacker from logging into your session.

So, yes, there is at least one reason to avoid automatic login, in the scenario described above. If, instead, your FDE is based on a traditional passphrase approach, then you are secure.

Improve this answer
0

I wondered this recently for a Windows laptop but decided on the following:

  1. If the laptop is sent to sleep and then stolen or accessed without my consent resuming from sleep does not require the FDE password, thus rendering the FDE moot. If you go out and your Linux machine is suspended and someone wakes it up then you're going to have similar problems.

  2. It's easier to recover the decryption key whilst the laptop is running. Windows has a command line tool to retrieve it if you're using BitLocker.

So I concluded to keep the FDE key safe it's probably best to make access to the OS difficult too.

Improve this answer
1
  • 2
    I think this describes a password-less account, which is not the same as just having auto-login. Good points, though.
    – Oleh Prypin
    Apr 19, 2019 at 6:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .