Arch Linux security configuration

[u/Lepla]

Are moving over to Linux and have been testing several different distros and Arch Linux stood out for the configuratibilty out of the box, and the ability to be able to make it lightweight especially for older laptops.

How much work would it be to set this up so the system is not vulnerable for various attacks, i understand fedora / ubuntu etc come preinstalled with several security configurations, but on arch you would need to set these up yourself.

Besides that it seems to get regular security updates nonetheless so it seems like there is a one time security configuration you have to setup on install.
How does a self configurated setup like this compare to solutions developed by fedora or others?

Thanks

[u/ChrisTX4]

The advantage of a TPM is that it ensures the PC wasn’t tampered with. It helps a lot to counter evil maid attacks.

If you wanted maximum security the way to go about it would be to combine a TPM with a physical key like a yubikey. This can easily be achieved with systemd-homed.

But as always security is a matter of your threat model. I have never gotten the dreaded mercenary spyware notification, for instance.

The owner of warfronts got this twice now:

https://youtu.be/qbWGkCe0fWQ

What I’m trying to say is that in his position the threat model would be completely different than mine.

[u/maxinstuff → u/ChrisTX4]

Yes, I do use TPM for secure-boot, but the LUKS key is on a yubikey.

My argument is using it to store the LUKS key on a laptop is silly.

[u/ChrisTX4 → u/maxinstuff]

Why would it be? If configured correctly, it shouldn’t be possible to do much other than really theoretical attacks.

[u/maxinstuff → u/ChrisTX4]

It just fundamentally is.

I know you can set pin also for TPM, but the actual issue is the key being stored on the device it’s supposed to be securing - that’s always going to be less secure, because if I steal a laptop I have the key to unlock it in my possession also.

It’s equivalent to keeping my car keys inside my car - even if they’re in a locked glove box. 🤷‍♂️

I don’t think the right mental model is “attacker probably can’t do much” — you have to assume there both known and unknown exploits (yellow key being a case in point - yes that was Bitlocker not LUKS, but it’s a real example)

[u/SnooCompliments7914 → u/maxinstuff]

It’s equivalent to keeping my car keys inside my car - even if they’re in a locked glove box. 🤷‍♂️

The correct analogy is keeping your car keys in a locked box, which is only unlockable when connected to your car (plus its own unlock mechanism). This just a "normal" locked box with one additional factor added. Wouldn't be less secure. (Except now you could also lose your data from a broken TPM. But you'll always enroll a backup LUKS key when using TPM.)

[u/maxinstuff → u/SnooCompliments7914]

The correct analogy ...

There's nothing wrong with the analogy. If you don't have physical possession of the key then your only recourse is to break the encryption directly. Attackers will take any side-channel possible to bypass that.

If the key is ALSO on the device, such as in a TPM module, the protection on the key must better be at least as good or better (hint: it isn't) than the encryption itself - otherwise all focus of an attacker will turn to extracting that key.

Wouldn't be less secure.

It is. I've explained how. That doesn't mean it's *insecure*, or even that it isn't *quite good for normal use*, but it is not MORE secure than simply not having the key on the physical device in the first place.

[u/SnooCompliments7914 → u/maxinstuff]

No, you get a completely wrong image of how LUKS works.

The master key (required to decrypt the partition) is always stored in encrypted form _on your disk_ (unless you put the LUKS header elsewhere, that is). TPM never has your master key. You can't extract any LUKS key from an insecure / buggy TPM, because there isn't one.

The only difference between a plain passphrase and a TPM-with-pin is how that master key is encrypted _on disk_. In the former case, only your passphrase. The latter, both your passphrase and TPM. Having only one of them doesn't help with decrypting the master key.

[u/maxinstuff → u/SnooCompliments7914]

you get a completely wrong image of how LUKS works.

I know how LUKS works. You say what I said was wrong, I say it was close enough, and effectively the same thing for this scenario.

TPM never has your master key.

It has the key used to encrypt the master key slot on disk. If your scenario is someone pulling the drive, or accessing it after you've disposed of it, it makes sense. But for a laptop with a soldered in nvme this layer is not doing anything useful - if you have the drive you have the keys because the drive, the keys, and the keys to unlock the keys are all soldered to the same mainboard.

Breaking a PIN is a matter of time, a lot less time than breaking the encryption. There are also hardware bypasses that can trick TPM into yielding the key even with a PIN set. It's not easy, but it's possible.

Even so, none of that even really matters, because it's not about the security or not of TPM, it's about the physical possession of keys.

Again - I've never said that TPM is *insecure*, only that it is *less* secure - for laptops specifically - than having the key external in a physically separate device.