Home » Questions » Computers [ Ask a new question ]

Want an easy to use Linux disk encryption scheme

Want an easy to use Linux disk encryption scheme

In the interests of protecting personal info in case a laptop gets stolen, I'm looking for the best way to encrypt a Linux system.

Asked by: Guest | Views: 260
Total answers/comments: 2
Guest [Entry]

"Your problem is a common one: mainly, the difficult balance between security and usability.

My suggestion is to use a slightly modified version of a mixed approach:

using cross-platform software like TrueCrypt prepare one or more encrypted volumes for your personal data that you DO NOT use daily (bank details, saved passwords, medical records, etc)
the reason to use more than one volume is that you might want to back them up on different media, or use different encryption schemes: for example, you might want to share your health records with somebody else and tell them your passphrase (which should be different for the one used for other volumes)
using a ""standard"" cross-platform software means you'll be able to recover your data from another OS on-the-fly, if your laptop is stolen/damaged
whole-disk encryption is often cumbersome and difficult. Although there are attacks for it (see the Evil Maid Attack it turns out to be useful if you're afraid of what could happen if people have access to the whole system. For example, if you're using a company laptop, have no administrative access and there are VPN keys that should not get stolen
cached passwords for mail/web/apps are another issue: perhaps you might want to encrypt only your home directory? To optimize performance and security/usability you could:

encrypt all home dir
softlink to a non-encrypted directory on your filesystem for data you don't care about losing (music, video, etc)

Again, do not forget that everything boils down on the value of what you have to lose, compared to the value of your time and cost of recovery."
Guest [Entry]

"You can use pend drive for storing encryption keys. For best security it should be password protected but it doesn't have to.

http://loop-aes.sourceforge.net/loop-AES.README look at example 7."