Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #190277

Re: GRUB and boot partition

Show all headers | View raw

Le 26/12/2017 à 02:47, microsoft gaofei a écrit :
> https://wiki.archlinux.org/index.php/GRUB#Boot_partition
> ArchWiki has carried an introduction of GRUB , it offers a feature to decrypt your partitions and you don't need to separate /boot . Debian also uses GRUB as its boot loader ,but Debian still separates /boot partition and leave it unencrypted

Indeed the Debian installer does not allow an encrypted /boot partition. 
IMO it should be treated as a (strong) warning, not as a blocking error.

You can still manage to have /boot encrypted on Debian with extra manual 
steps. The Debian 8 installer had a flaw that could be exploited : it 
did not detect when /boot was an LVM logical volume in an encrypted PV. 
But this trick does not seem to work any more with the Debian 9 installer.

Note however that in any case, the early part of GRUB cannot be 
encrypted. It is that part which asks for the passphrase. If you use 
encryption only for confidentiality (in case of loss or theft of the 
computer), it probably does not matter that /boot is not encrypted, 
because it usually does not contain any sensitive data. But if you use 
encryption for tamper-proof, then encrypting /boot is not enough, 
because someone with physical access to the computer could tamper with 
the unencrypted part of GRUB and modify it to install a keylogger, 
rootkit...

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

GRUB and boot partition microsoft gaofei <wangziheng@outlook.com> - 2017-12-26 03:40 +0100
  Re: GRUB and boot partition Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-12-26 10:50 +0100
    Re: GRUB and boot partition <tomas@tuxteam.de> - 2017-12-26 11:40 +0100
      Re: GRUB and boot partition Reco <recoverym4n@gmail.com> - 2017-12-26 11:50 +0100
        Re: GRUB and boot partition <tomas@tuxteam.de> - 2017-12-26 12:00 +0100
          Re: GRUB and boot partition Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-12-26 12:30 +0100
            Re: GRUB and boot partition <tomas@tuxteam.de> - 2017-12-26 12:40 +0100
          Re: GRUB and boot partition Reco <recoverym4n@gmail.com> - 2017-12-26 14:00 +0100
            Re: GRUB and boot partition Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-12-26 14:30 +0100
              Re: GRUB and boot partition Reco <recoverym4n@gmail.com> - 2017-12-26 14:50 +0100
              Re: GRUB and boot partition <tomas@tuxteam.de> - 2017-12-26 15:00 +0100
      Re: GRUB and boot partition Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-12-26 12:20 +0100
        Re: GRUB and boot partition <tomas@tuxteam.de> - 2017-12-26 12:30 +0100
          Re: GRUB and boot partition Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-12-26 12:40 +0100
            Re: GRUB and boot partition <tomas@tuxteam.de> - 2017-12-26 12:50 +0100

csiph-web