Linux encrypted boot security, was: CVE-2016-4484: - Cryptsetup Initrd root Shell

[Jason Cooper <osssecurity () lakedaemon net>]

Hi Jacobo,

On Thu, Nov 17, 2016 at 07:54:20PM -0500, Jacobo Avariento wrote:
> Actually when using full disk encryption, to lock the BIOS and GRUB must
> be mandatory, otherwise you are protecting your confidentiality but not
> your integrity. Even with a password in GRUB with an unprotected BIOS
> you can also boot from a USB device and access encrypted partitions,
> delete them, etc.

As long as the user in conscious of the threat model and makes the
deliberate decision, this is fine.  But please always advise folks,
"Physical access trumps everything.  Period."

I can't count the number of hard drives I've pulled and cmos' I've
reset.  That why I always advise moving all of the unencrypted boot
material (bootloader, /boot, LUKS header) to a separate thumbdrive and
to boot via USB.

Maintaining physical custody of the boot material keeps it more secure
and is easier for the user because there are fewer passwords involved.
And, with UEFI, you can update/configure it from within the OS, which
means the password for that can be kept in a password manager on the
encrypted volume.

thx,

Jason.