Linux

8055 readers

61 users here now

Welcome to c/linux!

Welcome to our thriving Linux community! Whether you're a seasoned Linux enthusiast or just starting your journey, we're excited to have you here. Explore, learn, and collaborate with like-minded individuals who share a passion for open-source software and the endless possibilities it offers. Together, let's dive into the world of Linux and embrace the power of freedom, customization, and innovation. Enjoy your stay and feel free to join the vibrant discussions that await you!

Rules:

Stay on topic: Posts and discussions should be related to Linux, open source software, and related technologies.
Be respectful: Treat fellow community members with respect and courtesy.
Quality over quantity: Share informative and thought-provoking content.
No spam or self-promotion: Avoid excessive self-promotion or spamming.
No NSFW adult content
Follow general lemmy guidelines.

founded 1 year ago

MODERATORS

[email protected]

Aeon Desktop Introduces Comprehensive Full Disk Encryption (news.opensuse.org)

submitted 3 months ago by [email protected] to c/[email protected]

4 comments fedilink hide all child comments

OpenSuse leading the development in regards to boot security, an area in which Linux Distros are lagging behind other operating systems.

Full Disk Encryption is designed to protect data in cases of device loss, theft or unauthorized booting into an alternative operating system. Depending on the hardware configuration of a system, Aeon’s encryption will be set up in one of two modes: Default or Fallback.

Default Mode:

This mode utilizes the Trusted Platform Module(TPM) 2.0 chipset […], Aeon Desktop measures several aspects of the system’s integrity. These including:

UEFI Firmware

Secure Boot state (enabled or disabled)

Partition Table

Boot loader and drivers

Kernel and initrd (including kernel command line parameters)

These measurements are stored in the system’s TPM. During startup, the current state is compared with the stored measurements. If these match, the system boots normally.

top 4 comments

sorted by: hot top controversial new old

[–] [email protected] 1 points 3 months ago

Is this different from UKI? If so, how? Thanks in advance!

[–] [email protected] 5 points 3 months ago (1 children)

FDE has been somewhat common in linux installers for a while now. Good to see more distros using the tpm though, afaik only ubuntu currently offers that graphically.

[–] [email protected] 11 points 3 months ago* (last edited 3 months ago) (1 children)

It‘s not only about using the tpm to unlock the FDE, you should be able to do that on every distro with systemd-cryptenroll. The part that is new, is the the measuring of the systems integrity. It’s a way to ensure that the firmware has not been tampered with, the boot loader is the one that was installed and has not been replaced, that the kernel is exactly the one that comes from the distribution, that the kernel command line is the one that we expect, and that the initrd that is used does not contain any extra binary that we do not control.

[–] [email protected] 2 points 3 months ago

I see. Thanks for clarifying