9

Recently I came across many Linux distributions. Before that I've been always using OpenSUSE so some things apparently were quite obvious to me - for example that it's possible and quite easy to set up full disk encryption or arbitrary, custom mount options on installer level. However it seems that actually such option is really exotic and apart from Arch Linux (where it's hard to call it "supported by installer"), probably Gentoo and OpenSUSE I couldn't find any distribution that allows you to encrypt whole disk (including /boot).

Just to avoid confusion - I'm talking about setup where first stage of GRUB asks for password before even showing GRUB menu to unlock initrd, then initrd asks for the same password again to load kernel and other stuff. In OpenSUSE installer it's performed automatically in case /boot is placed on encrypted LVM. However Debian, RedHat, CentOS, Ubuntu, Mint and probably all distros using similar installers claim it's incorrect configuration and refuse to install OS.

Are there any other non-specialized (means those strictly privacy oriented distributions like Tails or Whonix don't really count) distributions apart from mentioned 3 that support such installation scheme?

EDIT: In response to @henriquehbr to be 100% clear on what do I mean by full disk encryption:

enter image description here

There's no separate /boot partition. System asks for password twice: In GRUB: enter image description here

And after GRUB: enter image description here enter image description here

In the end there's only 1 partition which is encrypted LVM: enter image description here

However

What is referred to as "encrypted LVM" in all other installers I know: enter image description here

Is configuration with separate /boot partition. enter image description here

Trying to remove /boot partition results in following errors on Debian and Ubuntu: enter image description here enter image description here

Sorry for a lot of pictures but I wanted to make it 100% clear.

Improve this question
6
  • I didn't use either. I created encrypted LVM and then btrfs partition on that LV, mount under / and when clicked [ok] intaller told me that /boot has to be unencrypted :C
    – Lapsio
    Commented Feb 13, 2018 at 16:36
  • And lol mount options choice is given from predefined positions so there's no space_cache or autodefrag or compress options specific to btrfs...
    – Lapsio
    Commented Feb 13, 2018 at 16:40
  • /boot encryption is unusual and mostly pointless. If you really must have it, you can do it post-install. It should not narrow your distro choices.
    – frostschutz
    Commented Feb 13, 2018 at 17:18
  • @frostschutz You mean that /boot should be stored on external read-only medium? Well yes. But it's significantly less convenient as well. However while this time it didn't disqualify Debian - lack of custom mount flags did. Without compress=zlib flag it failed to install on 2gb HDD.
    – Lapsio
    Commented Feb 13, 2018 at 17:22
  • @Lapsio I'm trying to figure out the same problem. Did you ever determine whether it is or is not possible to encrypt /boot along with everything else?
    – Robert Dodier
    Commented May 23, 2018 at 23:48

2 Answers 2

Reset to default
1

I think all of the big name distributions do. Debian, Fedora, Ubuntu, openSUSE and so on. they may not advertise it as much as Ubuntu and Mint do, but the option is almost always there in the disk partitioning section of the installer.

EDIT: In reply to @Lapsio, i googled about this, and found that Ubuntu and Mint still support the full disk encryption during installation

Ubuntu 16.04

enter image description here

Mint 17.X

enter image description here

Improve this answer
5
  • The problem is Ubu and Mint don't support it either. I can only see it working in OpenSUSE installer. (and Arch and Gentoo allows you to do such thing as well but they don't really have conventional installer so I'm not sure if it counts). Ubu and Mint don't even allow you to install OS if disk is smaller than 8gb lmao.
    – Lapsio
    Commented Feb 13, 2018 at 17:12
  • Answer updated with proof of concept!
    – henriquehbr
    Commented Feb 13, 2018 at 17:43
  • 4
    It doesn't encrypt /boot. Hence it's not full disk encryption. It encrypts root partition but leaves /boot unencrypted. So initrd is not encrypted. Encrypting /boot requires additional steps and modifications to bootloader setup so it's less trivial.
    – Lapsio
    Commented Feb 13, 2018 at 18:15
  • updated question
    – Lapsio
    Commented Feb 13, 2018 at 19:43
  • @Lapsio It's true that /boot is not encrypted doing it this way but does it really matter. All you are worried about is your data especially in your home folder. I suppose if you were to encrypt your boot as well, you will be logging with your secret keys twice; Once for the boot and once for the rest of the hardrive.
    – ThN
    Commented Mar 2, 2019 at 15:02
-2

The old 32bit Linux Distros complied with your wishes... Something happened when 64bit Linux Distros released and that feature was forgotten. I would like it reintroduced.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .