Auto-Mounting an Encrypted LUKS Drive at Startup(chuck.is)
chuck.is
Auto-Mounting an Encrypted LUKS Drive at Startup
https://chuck.is/auto-mounting-luks/
2 comments
/root/$magicKey would need to be outside of the LUKS drive (unencrypted) for this to work (which isn't mentioned, and isn't even all that common on modern linux partition configs). This is about storing the key beside the encrypted drive - defeating the encryption (rendering LUKS storage overhead, but not security).
As already mentioned, this setup defeats the whole purpose of encryption: the key is stored near the encrypted partition.
However, it is still possible to get _some_ degree of protection with automounting encrypted drives:
You can setup SecureBoot with encryption keys stored in TPM.
Under SecureBoot security assumptions (motherboard firmware and TPM chip don't have backdors, etc.), this setup will release encryption keys and decrypt your drives only if your OS wasn't tampered with.
However, there are some _caveats_.)
However, it is still possible to get _some_ degree of protection with automounting encrypted drives:
You can setup SecureBoot with encryption keys stored in TPM.
Under SecureBoot security assumptions (motherboard firmware and TPM chip don't have backdors, etc.), this setup will release encryption keys and decrypt your drives only if your OS wasn't tampered with.
However, there are some _caveats_.)