Hello,
I’ve an HP EliteBook 840 G5 that I’ve been using up until now with Windows 10. I want to replace it with Debian 12 however since this is a laptop I would like to have my disk fully encrypted as well as the boot stage (initramfs etc).
My threat model: make sure if someone stoles the laptop, powered off, they won’t be able to access my data. I would also like to avoid evil maid attacks and make sure I’m not booting into some modified kernel / system with spyware or that will leak my TPM keys.
I’ve found some information online but I’m unsure of how secure those setups are and/or if it isn’t even possible to have the same level of security that Windows provides.
Here are a few of my questions:
- Anyone around here that has a similar HP laptop and did this?
- What about enrolling secure boot keys on the UEFI? From what I read simply using the typical Linux shim makes things more secure but it doesn’t fix the problem. Enrolling keys seems to break some motherboards
- Even if I use
--tpm2-pcrs=1,4,5,7,9how secure is that, should I add more? - What is the impact of this in system upgrades? How do I deal with those?
- If I want to proceed with this what I should know / what typically fails or can be problematic / security issue?
Some of the information I found:
- https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-fido2-pkcs11-security-hardware-on-systemd-248.html
- https://saligrama.io/blog/post/upgrading-personal-security-evil-maid/
- https://fedoramagazine.org/automatically-decrypt-your-disk-using-tpm2/
Thank you.
While I don’t know how well your hardware can work with secure boot, this is a good guide to get started on Arch. https://swsnr.de/2022/01/06/install-arch-with-secure-boot-tpm2-based-luks-encryption-and-systemd-homed.html Don’t know how well Debian supports any of the mentioned tools but you probably shouldn’t be going with Debian’s implementation of secure boot as it uses Microsoft’s keys.
I use TPM pcrs 0,1 and 7 with no issues across reboots and zero prompts to unlock LUKS as dracut resigns my kernel images on every update.
From what I can understand Debian uses a generic shim that is signed with Microsoft’s keys and then it delegates the rest to the system. Apparently this is a fast way to get secure boot to work but “SHIM only checks signatures of the boot loader and kernel, but not the GRUB config file or initramfs, which opens your machine to attacks”. This is why I was looking for a more detailed guide from someone who actually understands this from start to end.
fast way to get secure boot to work
vs best use of secure boot. Your pick.
Your GRUB can be encrypted behind FDE and iirc there is also an option to create a password for grub. So far I haven’t seen cases of bootloaders being compromised/bypassed so we are not there yet.
Pretty sure there’s not a lack of guides for setting up secure boot on Ubuntu/Debian, unless you are looking for something specific.
