I have been assured that this is possible, but have so far not found any reference that will clue me as to how to do it. I need to deploy an "appliance" with software and data that the user is permitted to use, but which I would prefer to keep them from poking around inside. The user will not have root access, so the running system should be protected. I want to stop the HDD being pulled and mounted elsewhere.
So far I have installed all but /boot into an Encrypted file system, and I am challenged for a password very early in the boot process. One of my colleagues heard from "somewhere" that TPM would be the solution to protecting the password challenge, which would allow the system to boot and unencrypt the root partition without root user presence. How do I get this working, been googling for various combinations a words, to no avail. I also installed a TPM-aware version of GRUB, but have no idea how/if this actually helps me.