I am currently installing a Debian distro on a new desktop computer and I am looking for pros/cons arguments for two ways of making the partition table (in matter of performance and security). My new computer has 16GB of RAM and a 500GB SSD (this should be enough for the specs).
First, I have a requisite which is to encrypt the working files. So, my first choice would have been:
#1 800 MB EFI #2 300 MB ext4 /boot #3 ..all.. crypto (sda3_crypt) LVM Encrypted (sda3_crypt) #1 10 GB swap #2 80 GB ext4 / #3 ...all.. ext4 /home
We need to encrypt the
swap in order to be sure to not leak any cryptographic data if we occur to use it. In fact, this is enforced now by the Debian installer.
But, then, I assumed that the system itself may be left unencrypted (I am not very happy with encryption everywhere even on my desk...). After all, only
/home is interesting.
So, the other alternative (my favorite one for now) is to leave the system unencrypted (only the
/home is). I guess it might add some security issues but I could not see any yet and I guess that will improve the efficiency. This second way of doing should look like this:
#1 800 MB EFI #2 80 GB ext4 / #3 ..all.. crypto (sda3_crypt) LVM Encrypted (sda3_crypt) #1 10 GB swap #2 ...all.. ext4 /home
So, did I miss something in matter of security ? Knowing that the adversary model is supposed to be the 'evil maid' that may be able to access physically the machine and possibly steal it while it is still switched on.
What kind of security breaches am I exposed to if I consider the second way to do ?
Finally, I will make sure that I have set up a
/tmp mounted through
tmpfs on the RAM. To prevent any critical write on the unencrypted part of the system.