Been doing a lot of reading on Linux encryption techniques, and one that I've come across is encrypting the /boot directory by keeping it on the same partition as the root. I recall reading somewhere that if you encrypted your /boot, you would need to modify GRUB or something every time your system updated. Can't remember where I read that, so not 100% sure if it's true or not. Are there any other disadvantages of having /boot encrypted?

  • @Panther I've seen some of your other posts and you seem to be knowledgeable with LUKS encryption. In your opinion, is encrypting /boot worth the hassle? Trying to get it setup with a keyfile so I only need to enter my password once has been a major pain. I'm considering just leaving /boot unencrypted and moving on. My laptop stays on a desk 99% of the time, so the risk of someone getting a hold of it is pretty low. From what I've read, even if someone were to steal it and mess with my /boot, they wouldn't be able to get the rest of my data without me entering the password, right? – Mr. Mann May 8 '18 at 19:26
  • The risk of an unencrypted /boot partition would be the evil maid scenario - ie someone installs a custom kernel or custom initrd , they then , in theory, could obtain you password or data once you boot. My /boot is not encypted and I will leave it that way. I will probably test an encrypted /boot in a VM and if it works well, next time I install I will use it so personally, with your current situation, go ahead and try to encrypt /boot. If you have a problem, post the error or a description of your problem and we will try to help. – Panther May 9 '18 at 6:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.