I heard that it is good practice to secure a laptop by encrypting your data. I’m of no importance and don’t hold state secrets or bank on my machines. However, when I choose encryption on install it rightly encrypts the boot? The OS and the User, so I’m having to put a password in 3 times. Is this necessary? What would you suggest?
You can unlock your drive automatically with TPM:
https://en.opensuse.org/SDB:Encrypted_root_file_system#Seal_the_LUKS_key_with_TPM_2.0
Encryption is always a good thing. Full-disk encryption, however, isn’t for everyone, and you should probably only do it if you know you need to.
But, an important point to note is that security is almost never only about you.
If you use any apps or services on your device where you communicate with others, having privacy and security is important for them as well. There’s also your logins, your browser, media (images, videos, etc.), and so on.
That said: is having to enter 3 passwords necessary?
No, it’s not necessary. Because the weakest link in a private and secure setup is usually what you do rather than what you don’t do. As a simple example, logging into multiple websites with the same password.
So, if you didn’t normally encrypt, and you haven’t run into any issues, it’s likely that what you’ve been doing is okay. But encryption can be useful when you least expect it.
Lastly, I only encrypt specific folders on my device using fscrypt. But there are other more user-friendly options like VeraCrypt.
I wonder where you are ask 3 times for a PW? I could guess 2 times, i.e. a PW for FDE and another PW for your user. — But 3 PWs: how/where?
And by the way, the hint about TPM holds: then you use just your user PW.
Basically you can encrypt your whole system. However before you start implementing anything you should work out which part of your system from your point of view will really need to be encrypted.
I for example keep all my private data (documents, pictures, …) on its own encrypted storage device which I will only mount when needed. The rest of my system is not encrypted.
However one should keep in mind that encrypting a storage device will even protect your data when your storage media fails (i.e. you can’t access its content due to a technical failure and therefore cannot override or delete the content of the device either). In such a case some expert may be able to recover the data but the data will be useless as it is still encrypted.
Here you can find a lot more of information on how to secure your system.
I need to PW on boot, then there is a general OS looking log in, then finally the user log in.
I’m sorry, but I only understood about 7 of the words in that description 
Are the PWs different?
Do you have 1, 2 or 3 different PWs? What (title/entitiy) are you asked for (FDE, user)?
In the past, I had FDE with an encrypted boot partitition: back then I was asked twice for the FDE PW. And then for user. — 2× FDE, 1× user, totally: 3×
Then I installed my system in a “proper” way (boot partition not encrypted, “just” the rest): I was asked only once for FDE. — 1× FDE, 1× user, totally: 2×
Now, I use TPM along with FDE. I am now asked only for the user. — totally: 1× (at user login, but not at booting up)
I started this Linux journey installing Mint on one Laptop. This gives the option of encrypting your home folder on install. I’ve moved to OpenSuse now and it also offers encryption, so I thought I would try it. I used the same password. But yes, got fed up with typing the password 3 times. I’ve reinstalled everything now, it’s gone smoothly. I will look into other forms of security, if needed at all.
Thanks to everyone for their help.
In theory you would need to enter the password only twice. Once to unencrypt the disk and boot the system. Once to login as a user after booting. The second login does not have to be the same password since it is the normal user.
There is a small issue though. The installer is not very good at partitioning logical volumes. It is difficult to put together the main partition and the swap partition as two logical partitions under the same physical encrypted volume. Hence at startup you have to unlock two separate partitions and enter the encryption password twice. The encrypted disk could be prepared before installing, but this is not something straightforward for the beginners.
1 Like
You could
- configure agetty to autologin tty1
# /etc/systemd/system/getty@tty1.service.d/override.conf
[Service]
# replaces original
ExecStart=
# - means treat non-zero exit as success preventing unit marked fail
ExecStart=-/sbin/agetty --noreset --noclear --autologin dza - $TERM
# - prevent spam after login with warnings
ExecStartPost=/usr/bin/dmesg --console-level err
- configure
SSH_ASKPASS|SUDO_ASKPASS=script.shto fetch your ssh/sudo password from somewhere… Thats on you to decide/secure that - but some password managers work like that.
That would save just one of the three passwords. But security wise would be weaker.
whats so bad about autologin on tty1 ? If you haven’t typed your FDE password its awaiting anyways.
Would be a first I know that unlocks his FDE password and walks away exposed to that… either way once FDE is unlocked everything is exposed anyways incl. physical access so you are owned either way if someone has access to it.
On the one hand, I agree - there is certainly a difference between encrypted data at rest on a storage device (and it being unlocked in order to access it) and encrypted data in motion (ie, via secure network protocols).
But I would be hesitant to autologin on tty1 in general because that login shouldn’t be needed during normal operations. It seems OP has reinstalled.
That said, you are absolutely correct that if an attacker has physical access to the system, all bets are (probably) off except in situations where that’s baked into the system’s setup (for example, protected UEFI that prevents booting from external devices, a physically locked case so the hard drive can’t be replaced, FDE on the internal drives, no ability to change the boot parameters in the boot loader - and even then there’s probably a way that it could be circumvented by a really determined attacker).
Security has nearly always been about balancing risk vs. “cost” (not a financial cost specifically, though that can be a factor as well). So ultimately, it’s a question of the individual’s risk profile as to whether or not (for example) autologin is an acceptable practice or not.
1 Like
Its probably just me who is oldschool, I don’t use a display/login manager - I felt the choices were all bad at the time.
I always considered the display manager a means to an end. But then again, I consider most technology a means to an end. 
1 Like
I vaguely remember there being a way to automatically login if your password was the same as your decryption password, I think it’s a systemd function, meant to look into it when I had some free time.
I disable SDDM and use greetd/tuigreet with custom Wayland-sessions that feed into a wrapper to customize kwinoutputconfig depending on whether I’m gaming downstairs or using my desktop. Could’ve done it with SDDM I guess but it’s easier with tuigreet.
Same here.
I see no need to encrypt /bin/ls and all the shared libs in /usr/lib64; that’s pointless IMHO. Personal data are another matter.
Still, I don’t encrypt my complete home directory because I know that I am my own worst enemy: My chance of messing something up and losing access is a far greater danger than any anonymous hacker intruding into my system.
So I am very selective with what I keep in my crypto vault.
Because you don’t ever know if secrets/tokens will be stored in /etc, XDG_ (.local,.config), /tmp, /var or wherever. Accidental writes can also happen from mistakes. FDE will ensure you’re never writing sensitive data to flash with TRIM operations you don’t control or can’t audit the firmware of to ensure cells are overwritten properly. Cross-device operations are also often more costly than everything on FDE.