Skip Navigation
Remote View
Linux @lemmy.ml
Jediwan @lemy.lol

Encrypted hard drive asking for password every time

I recently switched to Linux (Zorin OS) and I selected "use ZFS and encrypt" during installation. Now before I can log in it asks me "please unlock disk keystore-rpool" and I have to type in the encryption password it before I'm able to get to the login screen.

Is there a way to do this automatically like with Windows or MacOS? Zorin has biometric login which is nice but this defeats the purpose especially because the encryption password is long and tedious to type in.

Also might TPM have anything to do with this?

EDIT: Based on the responses I have to assume some of you guys live in windowless underground bunkers sealed off with concrete because door locks "aren't secure against battering rams". Normal people don't need perfect encryption they just want to add an extra hurdle or two for the crackhead who steals the PC. I assumed Linux had a system similar to what Windows or MacOS has been doing for a decade but I am apparently wrong.

125 comments

  • You ended up with full disk encryption. For most people, it's the simple option, everything is encrypted. That means the OS can't start without the key, because you're the only holder of the key. It's both dead simple, and pretty bulletproof since there's no way to access the system without the password. But as you said, not everyone wants that.

    What you're asking for is an encrypted home directory. It's not that Linux can't do it, it's just not what you got. Depending on the use case you can either use TPM to unlock the root partition to boot, or not encrypt the system itself. Then when you log in, it decrypts a separate partition (or use ZFS native encryption, or use fscrypt if your filesystem supports it, or use an overlay filesystem like go-cryptfs).

    So it's not that Linux doesn't support your use case but rather your distro doesn't offer it as an installation option. From there you either configure it yourself (ArchWiki is great regardless of distro), or seek out a distro that does.

    Linux is not an operating system, it's just the kernel. What makes it an OS is what distros build on top of it. Linux alone is not that useful, hence the basis of the GNU+Linux memes: it's Linux, plus a lot of GNU tools to make it do useful things, plus a desktop environment and a whole bunch of other libraries and applications, plus the distro's touch tying it all together in a mostly cohesive experience.

    • But I'm confused, the decryption of the home directory needs the owners secret to be entered at some point? I don't see how this solves Op's problem (which I also don't understand, you want encryption, you need to decrypt stuff at some point)

      • Yes, the question is when and how.

        You can enter it in the bootloader as a prerequisite to boot anything. You can also enter it at the display manager / login screen, which is a little further down the boot process.

        My desktop for example can boot up to the login screen and perform its NAS and routing duties all on its own. But my user and all of my user's data is still locked at that point: the computer is usable by guests and everything but even if you manage to throw a root exploit at it, my data is completely safe. Only when I log in, either locally or remotely, my password will go through PAM which will run a script that uses my password to unlock my home directory and mount it as I'm logging in.

        What changes is what is covered by the encryption, and when the key is required. My root is auto unlocked via TPM, my home is unlocked on demand as I log in to my user account.

        OP's problem is they have full disk encryption so they need the password to boot up Linux at all, but they also get a second password prompt to log in when it reaches the display manager, even if it's the same password. The solution is either they configure it to auto login since you need a password for the whole OS anyway, or they automate the unlocking of the root partition and use their login password to further decrypt the home directory (or rely entirely on the system being secure that the user isn't encrypted further and it's just a password prompt, which is what I think Windows does).

  • Others have given you ways of doing this, with TPM or hacking away by using the same password and auto-login. Many have told you you shouldn't, but I think no one explained why.

    When the bootloader chooses the OS that OS might be on an encrypted or an unencrypted disk. If the OS is on an unencrypted disk it can be easily hacked and then all bets are off. So the only safe option is if the OS is on an encrypted disk, however to do that you need to decrypt the disk to access it. Now there are two options, either you need to provide a key for decryption (it does not need to be a password, it can be a thumb drive or fingerprint) or it happens automatically. If it happens automatically it's the same as not having encryption.

    Enter TPM, which is trying to safely automatically decrypt the disk by using hardware validation. However here's the problem, the only reason you need disk encryption is to prevent against your hardware being stolen. If your hardware was stolen and you don't have disk encryption people can simply read the data. If you have disk encryption they need to decrypt the disk first. However when you use TPM or anything similar the disk gets decrypted automatically, meaning that it's almost the same as not having encryption at all.

    If a hacker got a hold of your unencrypted disk they can open it on a second OS and extract the data. If they got a hold of a fully encrypted disk they are more or less screwed. But if your computer unencrypted the disk on boot all they have to do now is access the disk from your OS. There are several ways of bypassing a login, brute force it, or create new users. Not to mention possible security issues that might give the attacker access to your entire system, which is already unencrypted. Yes, having some form of encryption, even if it unencrypts automatically is better than no encryption at all, but not by much. I would argue that if you care about the data not being accessed you shouldn't have it decrypt automatically, and if you don't mind it decrypting automatically then encryption might be overkill for you.

  • Thats how encryption works. Encryption with TPM protects against removing the drive and reading somewhere else, so I suppose it makes sense for most people.

    Linux Distros have this option, Ubuntu has it now I think, but on the others its often manual setup.

    Just search for "cryptsetup change to tpm"

  • If you want to do away with any protection you have with opting in to a security measure, like typing in a password, why don't you just reinstall and not select the encryption option?

    Not requiring a password, or automatically entering a password to decrypt the filesystem, is essentially the same as not having encryption.

    Decide which you want: Security or convenience. You cannot have both.

  • You dont want to do that.

    What's the point of encrypting something without a good passphrase? It defeats the whole purpose.

  • I use partial disk encryption myself using luksCrypt but without the auto unlock, your comment on the crackhead stealing it doesn't help you in that scenario, you 1000% can tie a partition encryption or home directory encryption and have it automatically decrypt using either a USB drive or TPM but, as is with Windows and MacOS if your PC gets stolen, the drive will be unlocked automatically regardless if it is you, it's only if the drive gets stolen on it's own that an auto unlock drive would help you, but it's not likely that only that will happen. At that point it might not be worth encrypting as a whole if that was your main concern.

  • There used to be exactly what you are looking for. Encfs, and later ecryptfs could encrypt just the data in your home folder.

    It was a checkbox in ubuntu installer, just like the full disk encryption today. The key was protected by the standard user password.

    Unfortunately, it was deprecated due to discovered security weaknesses, and I'm not aware of any viable replacement.

    • Systemd-homed does the same. But it is quite a huge change in the system, see this thread on the Fedora Discuss

      • Looks like it's creating a new volume in a file, but I don't see any type of quota being set upfront. If it scales up dynamically, it looks like a hot candidate. At this point I just hope distro maintainers settle down on something, anything, and give it a long term support.

  • as others have pointed out, you can use systemd-cryptenroll to add your tpm as a way to unlock the disk at boot, security of this should be fine if secureboot is enabled (for this to work it will need to be anyway) and a password is set for the uefi. See the archwiki entry for setup info (command is as simple as systemd-cryptenroll --tpm2-device=auto /dev/rootdrive, also the device needs to be encrypted with luks2, no idea if zorin uses that by default but you can convert luks1 to luks2 {backup ur headers first!})

  • I think people are misunderstanding the whole point of drive encryption. It's so that if the drive is stolen or lost, you don't have to worry about it as much. I personally don't see any benefit in doing this if I have to enter a password every time I plug the damn thing in. If you're concerned about somebody stealing your laptop or desktop, the disk-encryption should be the least of your worries.

    To the OC; if you happen to use GNOME, then check out the settings in the DISKS app. It has auto-unlock options in the per-drive settings. I long ago configured it so my USB is auto-unlocked upon being plugged in. Though after several system resets and such whatever I did to do that seems to no longer be visible in the GUI, I know that's how I set it up in the first place.

125 comments