Re:Desktop Linux Hardening
by TommyTran732 on Monday June 12, 2023 @05:24PM
(#36301377)
> Deleting it will not help since it'll get recreated by the next command that needs it. Empty it instead.
Interesting. Are you sure about this? The Wiki says it can be deleted and I did not see it coming back during my time with openSUSE. I can check it again later though.
Yes I'm sure, since I went through the same process of discovering it myself some months ago. I just tested it again to be sure.
It's also covered in https://forums.opensuse.org/t/zypper-uuid/135752
Re:Desktop Linux Hardening
by TommyTran732 on Monday June 12, 2023 @05:35PM
(#36301510)
Oh wow. I will update the post later today. Thanks for pointing it out!
I updated the OpenSUSE wiki page too.
LUKS/cryptsetup knows how to in-place encrypt and decrypt if you give it a place to put some metadata (16 MB in my experience):
cryptsetup reencrypt --encrypt -q --header /some/where/file /dev/mydev
cryptsetup reencrypt --decrypt -q --header /some/where/file /dev/mydev
I haven't looked into it but it might be possible to convert a non crypted disk to a cyrpted one.
If you have a live CD and enough spare disk space, you can create a new LUKS partition and dd / filesystem-specific-backup-restore your existing partition into it. You don't have to backup and reinstall.
If you're already using systemd-gpt-auto-generator to auto-detect the root partition, you just have to make sure the new partition has the expected UUID. Depending on your setup you might have to regenerate the initramfs though, say because it didn't already contain `/usr/bin/cryptsetup` etc.
>openSUSE uses a unique ID to count systems, which can be disabled by deleting the /var/lib/zypp/AnonymousUniqueId file.
Deleting it will not help since it'll get recreated by the next command that needs it. Empty it instead.
>Encrypted /boot [...]
>- openSUSE uses LUKS1 instead of LUKS2 for encryption.
>- GRUB supports PBKDF2 key derivation only, not Argon2 (the LUKS2 default).
Yes, the first point is because of the second point. There isn't a security difference between LUKS1 and 2 when using PBKDF2, so sticking with LUKS1 means you can't accidentally switch to non-PBKDF2 and end up with an unbootable system. But yes, switching away from grub as the next point talks about is ideal. And if you switch to UEFI boot with UKIs in /efi then you won't need a separate encrypted /boot anyway.