2

I'm starting a new job that requires full drive encryption for me to use my own computer. My new job will require telecommuting so I have to try to meet my new bosses security or I have to learn Windows again, I hate Microshaft so that is not an option. So here is the question...

Looking for better security and getting ready to re-install Ubuntu 14.04 with full encryption on the hard drive. I was told that I might want to install the boot sector onto a USB Drive for better security. Is this really the best way to do it? How big of a drive should I use for the boot? Once booted can I remove the drive after booting into Ubuntu and put the boot USB up till needed or till updates are done?

Or is there something I'm missing that is easier for the security. Yes my boss is paranoid about letting a Ubuntu computer any where near his network.

0

2 Answers 2

0

Having the boot loader (any of its stages) on a removable drive doesn't increase security – only obscurity. It doesn't classify as an additional authentication token, since it doesn't contain any secrets, just boot code. It also reduces ease of use.

Rather, you should do a normal installation with full-disk encryption with Ubiquity, Ubuntu's installer, and choose a secure pass phrase for boot authentication.

2
  • I have to do the full-disk encryption once I get the job, but I have been asking if there is more that can be done. I was told that with full-disk encryption if you do not have the original boot loader then you can not do anything with the drive. If that is not the truth then you are right, I'm just wasting time by removing the boot loader from the drive.
    – Johnathon
    Dec 14, 2015 at 12:14
  • Are you running Windows encrypted? And want to dual boot? Ubuntu's Standard full disk encryption will erase Windows as it uses LVM. If dual booting you probably have to install grub2's boot loader to another device as the encrypted Windows has to have its boot loader and manually create partitions then LVM encrypted logical partition.
    – oldfred
    Dec 28, 2015 at 15:23
0

Installing the bootloader to a USB Drive for may increase security a little but it will stop people from just turning on your computer and booting into the Linux. Without the USB flash drive plugged in.

Any Flash Drive should do for this.

  1. When you Get up to Installation Type Select Something else then click Continue

    enter image description here

  2. You will see this click on the drop down arrow and change your boot loader installation device

    enter image description here

Now your Boot loader will be installed on the USB device you selected.

1
  • Careful if it's a UEFI machine, the bootloader installation typically goes to the first disk regardless of what you select. Do it manually.
    – ubfan1
    Dec 28, 2015 at 16:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .