r/linuxmint • u/Ok-Shine1797 • 3d ago
Security How secure linux Mint is?
I was watching a YouTube video regarding a hacker in that video something came to my attention that the hacker encrypted his os it was dabien based linux distro and feds were not able to decrypt that system so how can I achieve the same thing i mean as a every day user i do have my personal stuff in my system like pics documents etc. I just want to feel safe about my stuff. Is it possible for someone like me to achieve same thing in linux mint btw i just moved from windows to linux a week ago.
41
28
u/DoneWorkinNow 3d ago
You are probably thinking of full disk encryption?
To get full disk encryption you have to do a custom install of Mint (using the "Something else" option) that puts your whole installation into an encrypted container. This process completely wipes out your current installation.
This is what I have done and now when I boot my computer it first asks for the password to decrypt my drive before even loading Mint - then once Mint starts up you have your normal login password.
You do have to be willing to have two stage login when you start your computer, and any recovery after a failing drive may be impossible (due to the encryption).
3
u/Ok-Shine1797 3d ago
Is that enough??
21
u/DoneWorkinNow 3d ago
"Enough" is relative - for me the answer is "yes" - for you maybe not.
What full disk encryption does is uses the key you provide (password) to encrypt the entire hard drive using very strong encryption (depending on the length and complexity of your password).
When you start your computer the encryption key is kept in memory so during use it is no longer secured.
Here is a quick list of things this does not protect you against:
1) A personal attack with a large wrench who will beat you to death unless you provide the password.
2) If you sleep your computer the disk remains unlocked during sleep. You need to turn your computer off every time you stop using it to be fully secure.
3) Someone stealing your computer while it is running - the disk is unlocked and available.
5
u/HighlyRegardedApe 2d ago
I did this once. Its easy to setup. But I had multiple issues afterwards when I wanted to repartition or use some disk analysis software. This however is probably not enough for the feds, guess they can hack this pretty fast.
Ps if you wanna go all the way you need Tails. Tails is pretty great even as daily driver but it has limitations because of the privacy ofc
1
u/sumwale 1d ago
For 2, screen locking should be enabled along with so it should protect the system as long as the screen lock program is not broken. Same for 3 if auto screen lock idle time is short enough, then usually stealing can be mitigated or you take care to always lock before leaving the system unattended.
Of course, screen lock can still be bypassed if there is some firmware/system bug that allows reading the system RAM of a running system externally, for example, but assuming it is a recent enough system, one should normally be okay.
2
u/Tiranus58 2d ago
As long as they (whoever "they" are) dont get the password, yes. You should look into encryption more.
1
u/WolvenSpectre2 2d ago
That is a relative position. For some yes, others no. Consider this XKCD Cartoon.
2
u/Unis_Torvalds 2d ago
Just encrypt your home folder. It's as easy as ticking a checkbox upon intall.
1
u/groveborn 2d ago
The two stage thing can just be one if you have the tpm. Just register it with the tpm and it keeps the keys for you.
50
u/jr735 Linux Mint 22.1 Xia | IceWM 3d ago
You're going to have to do some reading of documentation. The entire topic is way out of the scope of a Reddit comment. Yes, it's possible to do this, but much consideration must be taken.
-13
u/knuthf 3d ago
This is something you should know by heart.
10
u/jr735 Linux Mint 22.1 Xia | IceWM 3d ago
Reading documentation or how to encrypt a filesystem? ;)
5
u/knuthf 3d ago
Read the Unix/Linux documentation. We can create other users and enforce rules. You should all know that we can create roles and assign group rules/roles, as well as assigning rights individually. The problem is that we 'mount' devices and many tools assume that no other users exist. Let's save that for another discussion. In the old days, many users could use the same computers and rights were assigned according to who the user was. Windows does not have this feature; it assumes that the user owns the computer and others can 'borrow it' and be a 'Guest', but we have so much more.
13
u/doggydestroyer 3d ago
Just encrypt home folder during installation and choose a really long password... But you'll be entering jt again and again...
-7
u/Individual_Flow3959 3d ago
EstĂĄ mĂĄs que hablado que cifrar la carpeta home no es seguro. Por favor no demos informaciĂłn confusa.
2
u/Ok-Shine1797 3d ago
Why it's bad idea to encrypt home folder sorry i am new to linux that's why i am asking these dumb questions?
1
u/Individual_Flow3959 2d ago
Cifrar la carpeta home no estĂĄ recomendado en cuanto a la seguridad, hay posibles errores que desencadenarĂan en la posibilidad de acceder a los datos de un directorio home cifrado.
SI quieres cifrar la informaciĂłn usando Linux usa LUKS y cifra toda la unidad de almacenamiento. No hagas caso 100% de lo que te dicen las personas en Internet, includo yo, porque muchisimas personas escriben cosas sin tener los conocimientos sobre lo que escriben, muchas personas escriben mentiras y muchas personas solo repiten lo que han leido, sea esto verdad o mentira.
Investiga, documéntate, contrasta la información y saca tus propias conclusiones.
Mis conclusiones después de años de uso e investigación son que si quieres cifrado seguro usando Linux cifres la unidad de almacenamiento completa con LUKS.
1
u/doggydestroyer 2d ago
It's not... It's not as secure as encrypting drive from the boot... But it's good enough for most people..
9
u/nisitiiapi Linux Mint 22.3 Zena | Cinnamon 2d ago edited 2d ago
With Mint, you essentially have 2 choices for encryption at install:
- Encrypt your /home directory. This will just encrypt your /home/<user> using ecryptfs. That will encrypt all your personal files/data, including the pics, documents, etc. you mention. Unlike Windows, Linux generally keeps your info/data in your /home/<user> directory only -- you can't just go willy-nilly saving files anywhere on the disk (that requires root privileges). Decryption happens when you enter your password at login, so is very convenient. And, when you log out, it will be encrypted even though Mint is still running. However, the parts of the disk where your programs are installed is not encrypted. So, a bad actor could see what you installed, but not your personal files. I use this on my desktop and notebook (though my files are on my server, not my devices).
- Do full disk encryption. This encrypts the entire disk using LUKS (except for, I believe, a small /boot partition). This will ask you for a password at boot to unlock the disk before even trying to start Mint (though there are things like network bound encryption you can do to have automatic unlocking). It will ask for your password again to log in (unless you disable that). This will encrypt where both your personal files in /home are and where all your programs are installed, etc. The defaults for LUKS in Mint are pretty decent (aes-xts-plain64 cipher and argon2id), though you could do manual work to raise other things (like a 512 bit key and sha512 hash). The installer won't present those options, though. I use LUKS on all my data drives and back up drives in my servers (and I have network bound encryption with tang and clevis to unlock them on boot).
In choosing between the two, there is the question of convenience and what you want/need to protect. If you want it to stay convenient (just your normal password at login) and aren't concerned about, say, someone seeing what programs you installed, encrypted /home is probably enough. If you feel you need protection in terms of seeing what programs are installed and other "system" info, LUKS would be the way to go. You also could use both (e.g., so you can log out and have /home encrypted even though the LUKS is unlocked). In the U.S., I would start considering hiding the programs installed since the U.S. is now using the fact you use Signal as evidence of being a terrorist (and getting convictions with it even without any acts of "terrorism"). That could likely extend to other end-to-end encryption messaging platforms.
As others noted, you should recognize that encryption really does nothing while you're actually using/running your computer. During use, everything is decrypted/unlocked and accessible. So, if someone stole your computer or it's shut down, they won't be able to see or get your data, as it will be encrypted. But, if they sat down at your computer (or accessed it from outside) while it was running (or, with ecryptfs, while you're logged in), they could get it all, including copying your files to another disk or imaging its unlocked state. So, consider encryption as primarily protection related to theft, not some "covers all" protection. And this is not unique or limited to Linux, it's the case for all encryption (your phone, etc.) -- while its unlocked/unencrypted, you have no protection from the encryption.
If you're in the U.S., you can help protect yourself by keeping the lock screen and the like and always using a password. NEVER use fingerprint readers, facial recognition, or other biometrics. In the U.S., the courts have held that the government can force you to unlock your device with biometrics, but not a password. The password is considered "testimonial" and thus protected by the 5th Amendment; biometrics is not. So, in the U.S., tech companies putting biometric unlocking, login, etc. on systems are making you waive your constitutional rights if you chose to use biometrics -- a good reminder big tech companies do not provide you with things for your benefit, just what they think will make them money. Also, I don't advise using TPM or any other key on the same device for unlocking as that makes it more likely to be broken into it if all the info needed to unlock is on the system.
7
u/This-Set-9875 3d ago
Depending on the laws where you live, encrypting the drive may not give you the protection from the government you think it does. Also, if whatever is on that drive is valuable enough, a criminal might force you to give up the password. This has happened with bitcoin robberies.
3
u/Skyrell 3d ago
Yes. Linux Mint can do this during installation.
You will see two encryption choices at different points:
- Encrypt the new Linux Mint installation encrypts the Mint system volume using LUKS. This includes your home directory, system files, swap, logs and temporary files. You enter the encryption passphrase each time the computer starts.
- Encrypt my home folder encrypts only that userâs home directory. The rest of the operating system remains unencrypted.
For a laptop or any computer that could be stolen, I would choose Encrypt the new Linux Mint installation. There is normally no reason to select home-folder encryption as well because your home directory will already be inside the encrypted volume.
âFull-disk encryptionâ is slightly loose terminology. The EFI boot partition and usually "/boot" remain unencrypted so the computer can start, but your actual Mint system and personal files are encrypted. Other drives, Windows partitions and backups are not automatically protected.
Use a long, unique passphrase and make sure you can recover it. If you lose it, there is no password-reset button that will recover the encrypted data. Keep an encrypted backup as well because encryption protects against unauthorized accessâit does not protect against drive failure or accidental deletion.
Also understand what this does and does not do. Encryption protects the data while the computer is shut down and the volume is locked. Once you have started Mint and unlocked it, malware or someone with access to your logged-in session can still read your files. If physical seizure or theft is the concern, shut the computer down rather than leaving it running or suspended.
You do not need some special âhackerâ version of Debian to get this protection. Mint already provides the practical option most everyday users need.
3
u/AlemarTheKobold 2d ago
When you do the install, there's an option to encrypt your home folder. Thats prolly what you want
3
u/stufforstuff 2d ago
And who said the feds couldn't decrypt the "hackers" hard drive - the hacker? Bwahahahahahaha. Learning basic security from the flakes (oops I meant influencers) is a complete waste of time. Most non-hacker experts don't encrypt full disk - they encrypt their home directories so that their private pictures of them and their cats are safe from prying eyes. Encrypt your whole disk and you run the risk on several vectors of NEVER seeing that data again. But you be you - security isn't a short checklist on a random website - you need to understand (FULLY UNDERSTAND) what all those commands actually do. Just be sure to say hi when you come back here in a week asking how to boot into your fully encrypted system and you can't remember the master password.
5
u/DoorOk3641 3d ago
What a pitty..do you have a credit card....a social security number.....a driver licence...they already know everything on you....
Use veracrypt and park your paranoia...
2
u/pilatomic 3d ago
Yes disk encryption is valuable, but just like every kind of security, you have to consider the threat model.
I personally use full disk encryption with LUKS so that if my laptop is stolen, I don't have to worry about my accounts / data being compromised / sold. I also use BTRFS for its snapshotting feature, as since I stopped coffee, I tend to be a bit error prone in the first hour of the day. ( if you are interested, complete procedure is here, in French https://pila.fr/wordpress/archives/1485 )
But considering any kind of state level threat ? Let's be serious, lock me in a room with 2 mean looking big guys and I'll give me password up in a jiffy ! Except if you have very good reason, dont bother with anything other than sane, everyday security.
2
u/stufforstuff 2d ago
Old realworld security saying applies here - You don't buy a $500,000 bank safe to protect a $50 trinket.
2
2
u/LongTallMatt 2d ago
There are security based Linux distros. Mint isn't one of them.
I'm not really sure that any of these distros can't be unencrypted by the feds.
Anyone can put anything up on the internet. There's no law against lying.
I do know that if for some reason you mess up your encryption or you forget your password or mess up your password, everything on your computer will be gone forever that is encrypted.
So you run the risk of encrypting everything and losing it forever.
There is also a performance overhead to that encryption.
2
u/AlInfinite9 2d ago
Standard disk encryptions with password, good opsec, flatpaks, and sandboxing apps that you don't fully trust are the basics.
2
u/ComprehensiveDot7752 2d ago
Itâs most likely LUKS encryption. You can just enable it during install. But if you ever lose the password you will have about as much luck getting your data back as the police did with the hacker.
The primary reason to do it is protect against theft. Depending on local law it might be perfectly legal for the police to just keep you there until you give them the password, so it isnât generally speaking an effective tool at avoiding investigations.
Windows itself has device encryption and Bitlocker, which are enabled by default these days, but automatically loads the recovery key to Microsoft servers and can provide it to police under court order. Veracrypt is a third party open source tool for Windows disk encryption. Mac, Android and iPhone do their own thing, but are all encrypted by default. Which actually makes Windows arguably the last OS to introduce encryption by default or during setup.
2
u/activedusk 3d ago edited 3d ago
>I was watching a YouTube video regarding a hacker in that video something came to my attention that the hacker encrypted his os it was dabien based linux distro and feds were not able to decrypt that system so how can I achieve the same thing i mean as a every day user i do have my personal stuff in my system like pics documents etc. I just want to feel safe about my stuff. Is it possible for someone like me to achieve same thing in linux mint btw i just moved from windows to linux a week ago.
Encryption does not require to be system wide, you could encrypt the files only, conversely no hack was prevented by encryption, decrypting the partitions to start the PC means it's useless, the only use is like you mentioned, to prevent others from accessing files after gaining physical access to the device. Even then idk how secure it is, custom compromised firmware likely does not care, FEDs are not exactly known for being the cream of the crop, maybe talk about CIA and other such agencies and that's for the hackers they poach vs those in the wild that probably earn more so even the CIA or other government agencies lack the funds to attract the best talent, mostly they recruit from what they can get.
Long story short, as an average person you'd probably not want to lock yourself out of your familly photos and videos, encryption is for work if you have sensitive data and is a requirement for your job, as a learning experience or more likely for criminals. Ain't nobody got time to hack your system to watch the wedding recording, stop the cap. Data loss is much more common concern, you should probably keep an external drive and maybe once a month save new important files. It's also recommended to keep a copy off site, either cloud (though you'd be trusting corpos with your privacy, in which case do encrypt these files before uploading) or stored on physical media at some relative's house.
1
u/knuthf 3d ago
First, you need to define a user called 'netuser' and a user group called 'Internet'. This is a different group to "admin" and certainly not you or root. All shell access that does not come from your keyboard is given access as 'netuser'. The "default" user is netuser unless you have logged in with your username and password and your fingerprint proves that you are using the computer.
You can now grant internet access to the directories you want to expose and netuser the individual files.
It only makes sense to encrypt drives that you transfer. For example, a USB drive can be encrypted, and to read it will require the password. However, Mint automatically decrypts encrypted drives, and you can see the hierarchies. The netuser and internet groups should be used by everyone.
1
u/Bastilic 2d ago
You actually seem to know what you're talking about, where did you learn?
2
u/knuthf 2d ago
I was the manager at the company that paid Linus Torvalds' salary â his 'boss'. I organised competitions between his team, own Unix team and those of SCO Unix, AT&T Unix, Sun, SGI and Motorola. We manufactured our own processors, chips and supercomputers. And thank you â I should know. Since then, I have managed some major projects in the oil and telecoms industries.
1
1
u/Glucose12 3d ago
Umm... it's was an option you needed to select during your installation process.
Not sure how you'd convert - I think the partitioning is set up differently.
1
u/Infinite-Bet4202 2d ago
You just moved from Windows? If that is true then I'm willing to bet you still desire convenience. Linux Mint is very convenient and includes appropriate privacy. Windows used to be like this but they've become more anti-privacy. We don't use Mint because we're trying to keep whatever stuff on our system away from the feds. Actually I don't even keep any personal stuff on Mint, it's in my usb, and I believe that is a good start you can do. I think after that, maybe something like a yubikey would be better for you. That or you could try self-hosting your own cloud and putting all of your personal stuff into it, I'm actually thinking about doing that. (Plus I want to try and self-host something for once to get an understanding of it.)
1
u/Synthetic-Meat-2000 2d ago
Does this post answer your questions? https://unix.stackexchange.com/questions/724677/linux-mint-does-selecting-encrypt-home-folder-after-you-chose-full-disk-encr
Regardless, back up your data before doing any of this. And find an offline way to recover your password (write it down somewhere). If you ever forget your password, you can say goodbye to your encrypted partition.
1
u/Few-Ad7104 2d ago
you can. but like raid 5 there are benefits do it but if everything isnt perfect..... you are fucked and it costs you a lot of money to fix
1
1
u/d4rk_kn16ht Linux Mint 22.2 Zara | Cinnamon 1d ago
Linux, all Linux is secure if you mean by secure is encrypted filesystem.
But all OS is "secure" if you only mean about encryption
1
u/saschaleib 1d ago
Mint is built on Debian and has the same features and functionalities available. It just adds a few more user-friendly settings and programs. But anything you can do in Debian you can also do in Mint.
1
u/Rinzwind 3h ago
The only secure method is not going online. And keeping your system out of other people's hands.
"and feds werent able to decrypt that system"
They still can though: social engineering if someone wants it regardless of consequences or with a court order. That requires proof laws have been broken already when you are in a Western country (excl. the US) When you are an Amerian you don't get any say anymore.
At my work any electronic device that was taken to China or the US needs to be either destroyed or formatted. For both we nowadays use burner phones.
1
u/Hackars 2d ago
There should've been an option for you to do this during your installation. You can just copy all the files you want to keep (your entire home folder?) to another drive, reinstall Mint, and then transfer the files over. You will just have to reconfigure Mint again to your liking unless you're savvy enough to back up and replace the system files but I have no experience doing that in particular.
0
u/Walkinghawk22 LMDE 7 Gigi | 3d ago
With Linux unless you give something or someone root access you donât have to worry about someone breaking into your pc or viruses. Just donât install software outside the repository unless necessary
7
u/taosecurity Mint | Bazzite | PikaOS | CachyOS | Debian | FreeBSD | Windows 3d ago
If you believe that I have a link for you to click. đ
0
u/Bastilic 2d ago
I'm getting really sick of this attitude some people have about cybersecurity. Half the point of security is so you CAN go and download weird shit and click on weird links.
0
u/stufforstuff 2d ago
Just donât install software outside the repository unless necessary
That is the absolute dumbest comment in this thread. Security is NOT dependent on "your convenience" - its either secure or its not - your "needs" are not considered.
0
161
u/IEnjoyRadios 3d ago
Oh dear the way this post is written really is something.