Full Disk Encryption: Difference between revisions
Artoria2e5 (talk | contribs) |
Add section about SDDM autologin using LUKS password |
||
| Line 1: | Line 1: | ||
There are a few options for full disk encryption. The easiest way is to use the graphical installer and choose | There are a few options for full disk encryption. The easiest way is to use the graphical installer and choose "encrypt" while doing the installation. | ||
= LVM on LUKS = | = LVM on LUKS = | ||
| Line 277: | Line 277: | ||
Again, the secondary drive will be unlocked and made available under <code>/dev/mapper/cryptstorage</code> for mounting. | Again, the secondary drive will be unlocked and made available under <code>/dev/mapper/cryptstorage</code> for mounting. | ||
= Autologin using LUKS password = | |||
One downside of full disk encryption is that you need to type in your password twice, once for unlocking the disk and once to log into your desktop. One approach is to skip the LUKS password, such as by using a TPM2, but is [https://oddlama.org/blog/bypassing-disk-encryption-with-tpm2-unlock/ difficult to properly secure]. The other approach is to enable autologin for your display manager: | |||
<syntaxhighlight lang="nix"> | |||
{ | |||
services.displayManager.autoLogin.user = "my username"; | |||
} | |||
</syntaxhighlight> | |||
However, this breaks software such as KWallet which uses the login password to automatically unlock its keyring. The solution is to set the LUKS password, login password, and KWallet keyring password all to the same string, and then use the LUKS password to unlock KWallet. The LUKS password is first collected by a systemd initrd, saved to the kernel keyring, read out by SDDM via a PAM module, then finally passed off to KWallet. | |||
<syntaxhighlight lang="nix"> | |||
{ | |||
boot.initrd.systemd.enable = true; | |||
systemd.services.display-manager.serviceConfig.KeyringMode = "inherit"; | |||
security.pam.services.sddm-autologin.text = pkgs.lib.mkBefore '' | |||
auth optional ${pkgs.systemd}/lib/security/pam_systemd_loadkey.so | |||
auth include sddm | |||
''; | |||
} | |||
</syntaxhighlight> | |||
= Further reading = | = Further reading = | ||
| Line 287: | Line 308: | ||
* [[Remote disk unlocking|Using Tor and SSH to unlock your LUKS Disk over the internet]]. | * [[Remote disk unlocking|Using Tor and SSH to unlock your LUKS Disk over the internet]]. | ||
* [[Bcachefs]], filesystem which supports native encryption | * [[Bcachefs]], filesystem which supports native encryption | ||
* [https://discourse.nixos.org/t/full-disk-encryption-tpm2/29454/2 Automatically unlock encrypted disks using | * [https://discourse.nixos.org/t/full-disk-encryption-tpm2/29454/2 Automatically unlock encrypted disks using TPM2] | ||
[[Category:Desktop]] | [[Category:Desktop]] | ||
[[Category:Server]] | [[Category:Server]] | ||