Comment on Encrypting without full disk encryption question
partial_accumen@lemmy.world 1 week ago
assuming I’m worried about a smash and grab
For your specific use case, how about this:
Get a cheap USB thumb drive and a long USB cable. Put your disk unlock password on that thumb drive, and semi-permanently affix the USB drive to your building. You said you’re in a basement. Put it on top of a rafter with a metal fitting that would keep the drive from being taken without removing the screws. Run the long USB cable from the thumb driving in your rafter to the USB port on the machine. Alter your startup script to mount the thumb drive read the password from the thumb drive to unlock your main disk. Don’t forget to immediately unmount the thumbdrive in the OS after the disk is unlocked for extra safety.
If someone is doing a smash and grab, they’ll unplug all the cables (including this USB cable going to the thumb drive) and take your machine leaving the disk encryption password behind on the USB thumb drive.
JustEnoughDucks@feddit.nl 6 days ago
This is similar to what I do.
I have a USB drive with the whole bootloader + decryption keyfiles on it. I remove it while it is running as everything is stored in RAM and already booted.
Downside being it has to be plugged in to update the boot partition during an upgrade.