I’m setting up FDE and wonders which one is better. “LVM over LUKS” or “LUKS over LVM”? Or something else? Does one is definitely better then the other? What are your preference?

Thanks.

  • umami_wasabi@lemmy.mlOP
    0·
    9 months ago

    For secure bypasses I could only find BlackLotus is the only one capable to do this. I would like to have more details to support the claim “Secure Boot has been hacked in a minute.” Also, I would like the explanation on secure boot is a false sense of security and points to suport such claim as BlackLotus is the only publicly known malware to bypass secure boot.

    However, I do firmly believe that there ia no reason that servers can’t use FDE as they are no differ than other typical computer.

    • NaN@lemmy.sdf.orgEnglish
      0·
      9 months ago

      I think people tend to get hung up on where you store the key material for a server. Hardware token and TPM being two options that are less secure, but network bound disk encryption is supported as well as a combination. So you could have it require the network key as well as the matching PCRs from the TPM for the proper software load before it will unseal.

        • NaN@lemmy.sdf.orgEnglish
          0·
          9 months ago

          If I steal the server I have the token, unless someone is physically going to unlock the server every time you reboot which is not realistic.