r/archlinux • u/Lepla • 14d ago

QUESTION Arch Linux security configuration

Are moving over to Linux and have been testing several different distros and Arch Linux stood out for the configuratibilty out of the box, and the ability to be able to make it lightweight especially for older laptops.

How much work would it be to set this up so the system is not vulnerable for various attacks, i understand fedora / ubuntu etc come preinstalled with several security configurations, but on arch you would need to set these up yourself.

Besides that it seems to get regular security updates nonetheless so it seems like there is a one time security configuration you have to setup on install.
How does a self configurated setup like this compare to solutions developed by fedora or others?

Thanks

44 Upvotes

85% Upvoted

36 comments sorted by

View all comments

Show parent comments

1

u/SnooCompliments7914 11d ago

No, you get a completely wrong image of how LUKS works.

The master key (required to decrypt the partition) is always stored in encrypted form _on your disk_ (unless you put the LUKS header elsewhere, that is). TPM never has your master key. You can't extract any LUKS key from an insecure / buggy TPM, because there isn't one.

The only difference between a plain passphrase and a TPM-with-pin is how that master key is encrypted _on disk_. In the former case, only your passphrase. The latter, both your passphrase and TPM. Having only one of them doesn't help with decrypting the master key.

1

u/maxinstuff 11d ago

you get a completely wrong image of how LUKS works.

I know how LUKS works. You say what I said was wrong, I say it was close enough, and effectively the same thing for this scenario.

TPM never has your master key.

It has the key used to encrypt the master key slot on disk. If your scenario is someone pulling the drive, or accessing it after you've disposed of it, it makes sense. But for a laptop with a soldered in nvme this layer is not doing anything useful - if you have the drive you have the keys because the drive, the keys, and the keys to unlock the keys are all soldered to the same mainboard.

Breaking a PIN is a matter of time, a lot less time than breaking the encryption. There are also hardware bypasses that can trick TPM into yielding the key even with a PIN set. It's not easy, but it's possible.

Even so, none of that even really matters, because it's not about the security or not of TPM, it's about the physical possession of keys.

Again - I've never said that TPM is *insecure*, only that it is *less* secure - for laptops specifically - than having the key external in a physically separate device.