Other flavours have their own installers and themes and may not look identical.ĭesktop installer ISO image from copied to installation media (usually a USB Flash device but may be a DVD or the ISO file attached to a virtual machine hypervisor). Illustrations (screen-captures) are taken from the Ubuntu 19.04 'Disco' Desktop Installer. Unfortunately, Canonical (who control the building of the packaged signed GRUB UEFI boot-loader) did not include the encryption modules in their signed GRUB EFI images until the release of 19.04 Disco. It is possible, in UEFI Secure Boot mode, to have every stage cryptographically signed, in which case any tampering can be detected and boot aborted.
In both cases the first-stage GRUB boot-loader files are not (and cannot) be encrypted or protected through cryptographic signatures in BIOS boot mode. However, this is much better than the Ubuntu installer Encrypt Disk option which only supports encrypting the operating system partition but leaves the boot-loader second stage file-system unencrypted and therefore vulnerable to tampering of the GRUB configuration, Linux kernel or more likely, the initial RAM file-system ( initrd.img). What is encrypted are the operating system partition and the boot-loader second-stage file-system which includes the Linux kernel and initial RAM disk. I'm (Tj) being deliberately pedantic in calling this almost Full Disk Encryption since the entire disk is never encrypted. It is intended to replace the current (hopelessly out-of-date and inadequate) FullDiskEncryptionHowto page.
THOSE WHO REMAIN SCRIPT 2019 MANUAL
It is also a useful overview on the manual steps required for storage-at-rest encryption. It requires 36 commands be performed in a terminal, all of which are shown in this guide and most can be copy and pasted.
THOSE WHO REMAIN SCRIPT 2019 INSTALL
It is focused on modifying the Ubuntu Desktop installer process in the minimum possible way to allow it to install with an encrypted /boot/ and root file-system. This page is an up-to-date guide ( last revised August 2022) to comprehensive LUKS encryption, including GRUB, covering 18.04 LTS and later releases.
Further support may be available from the official Ubuntu support community IRC channel #ubuntu on Libera ( or ).
0 kommentar(er)
