Linux Mint 19.X (but also Ubuntu) with Full Disk Encryption, directory /boot included - PC with firmware UEFI & HDD with GPT partitioning scheme - Booting with EFI STUB loader

linux22
  2 weeks ago
  0

Linux Mint 19.X with Full Disk Encryption, directory /boot included
PC with firmware UEFI & HDD with GPT partitioning scheme - Booting with EFI STUB loader
Author: Naldi Stefano (linux22 at Mint Forum)
First Release: 30 January 2019
Version 1.1
Last update: 29 October 2019

Hits since 30/01/2019  website counter

 

 

Coming soon ...

- Twin tutorial concerning a project with LVM for system with separate swap partition and active Hibernate function

Release within the end of November

 

_____________________________________

 

I have developed this new solution for Linux Mint Full Disk Encryption (FDE) with PC UEFI & HDD GPT.

In this new project I am abandoning the standard boot loader GRUB, replacing it with the EFI STUB loader.

This new solution has the following PROS and CONS:

PROS:

  • VERY FAST BOOTING
  • VERY FAST SHUTDOWN
  • VERY SIMPLE
  • SUPPORT FOR TYPE 2 LUKS ENCRYPTED PARTITIONS (LUKS2)
  • FULL DISK ENCRYPTION (FDE) REQUESTING ONLY ONE PASSWORD AT BOOT-UP
  • NO LUKS UNLOCK KEYFILES REQUIRED
  • NO LVM REQUIRED
  • NO MORE HEADACHE FOR GRUB UPDATING AND/OR UPGRADING
  • WORKS (WITH MINOR CHANGES) ALSO ON LINUX 32-BIT SYSTEMS (TESTED ON VIRTUAL MACHINES ONLY)


CONS:

  • POINTLESS AND/OR POTENTIALLY DANGEROUS FOR FULL DISK ENCRYPTION (FDE) SYSTEMS IF SECURE BOOT IS DISABLED
  • POOR CONFIGURATION OPTIONS (COMPARED TO GRUB)
  • NOT COMMON / NOT STANDARD
  • NEED GREATER EFI PARTITION SIZE (MINIMUM RECOMMENDED SIZE 1GB)

 

_____________________________________

 

 

Other tutorials concerning Linux Mint with Full Disk Encryption, directory /boot included:

 


Table of contents


GNU Free Documentation License

GNU GENERAL PUBLIC LICENSE

Disclaimer and acknowledgments

Useful links

LINUX MINT FDE INSTALLATION FOR PC WITH UEFI AND HDD WITH GPT, EFI STUB LOADER

Step 1 - Set up for Ubiquity configuration file '/lib/partman/check.d/07crypto_check_mountpoints', require a basic text editor

Step 2 - Set up of HDD and partitions, require a few Terminal commands

Step 3 - Set up of the Linux installation, require Ubiquity

Step 4 - Configuring the EFI STUB loader for the Linux Mint FDE installation, require a lot of Terminal commands

Appendix A – Emergency tools - How to access your encrypted partition with your Mint or Ubuntu Live CD

Appendix B – Emergency tools - How to reinstall EFI STUB loader after ...

 

 

GNU Free Documentation License
Version 1.3, 3 November 2008

Linux Mint with Full Disk Encryption, directory /boot included - PC with firmware UEFI & HDD with GPT partitioning scheme - Booting with EFI STUB loader

Copyright (C) 2019 Naldi Stefano.

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.

You should have received a copy of the "GNU Free Documentation License" along with this document.

If not, see < https://www.gnu.org/licenses/fdl.html >.


GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007

Linux Mint with Full Disk Encryption, directory /boot included - PC with firmware UEFI & HDD with GPT partitioning scheme - Booting with EFI STUB loader

Copyright (C) 2019 Naldi Stefano

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the "GNU General Public License" along with this program.

If not, see < https://www.gnu.org/licenses/gpl.html >.

 

 

Linux Mint Full Disk Encryption (directory /boot included) installation - PC with UEFI and HDD with GPT, EFI STUB loader

I wrote this guide/tutorial with the hope that it will be useful for everyone who need a Linux installation with Full Disk Encryption. The solution here reported is EXPERIMENTAL and need a good experience with Linux and its installation. At the moment I have successfully experimented this solution with Linux Mint 19.X Cinnamon and Mate, Ubuntu 17.10 and above, all 64 bit version.
This guide/tutorial comes with ABSOLUTELY NO WARRANTY.

Prior of all I must thank Matthew Bentley (https://bentley.link/secureboot), because his publications show very well the whole process of building and configuring a reliable EFI STUB loader for Linux systems. You can see that his solution was published on 12 May 2016, more than 2 year ago.

Another thanks go to Michal Krenek (Mikos) for its 'cryptboot' software package (https://github.com/xmikos/cryptboot). In a few pages he has condensed all we need to BUILD and RUN a working UEFI Secure Boot Linux installation.

Altought these two software solutions seem both developed for ArchLinux we can find within them the rights commands and advices for almost every Linux distribution.


Other useful links are these:

 

 

The topic for this tutorial at the Mint Forum is: https://forums.linuxmint.com/viewtopic.php?t=198077

 

 

You can download the last version of this tutorial in pdf format from the link below:

 

Linux Mint 19.X with Full Disk Encryption, directory boot included - System UEFI & HDD GPT - NO LVM - Boot with EFI STUB loader