search

xmikos / cryptboot

Encrypted boot partition manager with UEFI Secure Boot support
GNU General Public License v3.0
204 stars 24 forks source link

readme

cryptboot

Encrypted boot partition manager with UEFI Secure Boot support

Description

With encrypted boot partition, nobody can see or modify your kernel image or initramfs. GRUB boot loader supports booting from encrypted boot partition, but you would be still vulnerable to Evil Maid attacks.

One possible solution is to use UEFI Secure Boot. Get rid of preloaded Secure Boot keys (you really don't want to trust Microsoft and OEM), enroll your own Secure Boot keys and sign GRUB boot loader with your keys. Evil maid would be unable to boot modified boot loader (not signed by your keys) and whole attack is prevented.

cryptboot simply makes this easy and manageable.

Requirements

Installation

  1. Install your favorite Linux distribution with separate /boot partition encrypted with LUKS. Refer to your distributions documentation, there is e.g. guide for Arch Linux:

    Encrypted boot partition (GRUB)

  2. Boot into UEFI firmware setup utility (frequently but incorrectly referred to as "BIOS"), enable Secure Boot and clear all preloaded Secure Boot keys (Microsoft and OEM). By clearing all Secure Boot keys, you will enter into Setup Mode (so you can enroll your own Secure Boot keys later).

    You must also set your UEFI firmware supervisor password, so nobody can simply boot into UEFI setup utility and turn off Secure Boot.

  3. Boot into your Linux distribution and mount /boot partition and EFI System partition:

    cryptboot mount

  4. Generate your new UEFI Secure Boot keys:

    cryptboot-efikeys create

  5. Enroll your newly generated UEFI Secure Boot keys into UEFI firmware:

    cryptboot-efikeys enroll

  6. Update GRUB boot loader (it will be automatically signed with your new UEFI Secure Boot keys):

    cryptboot update-grub

  7. Unmount /boot partition and EFI System partition:

    cryptboot umount

  8. Reboot your system, you should be completely secured against evil maid attacks from now on!

Usage

After installation, usage of cryptboot is as simple as running:

cryptboot upgrade

This will mount /boot partition and EFI System partition, properly upgrade your system with distributions package manager, update and sign GRUB boot loader and finally unmount /boot partition and EFI System partition.

Help

cryptboot

Usage: cryptboot {mount|umount|update-grub|upgrade}

Encrypted boot partition manager with UEFI Secure Boot support

Commands:
    mount        Unlock and mount your encrypted boot partition and EFI System partition
    umount       Unmount and lock your encrypted boot partition and EFI System partition
    update-grub  Update GRUB2 boot loader and sign it with your UEFI Secure Boot keys
    upgrade      Mount, upgrade system with package manager, update boot loader and unmount

cryptboot-efikeys

Usage: cryptboot-efikeys {create,enroll,sign,verify,list} [file-to-sign-or-verify]

Manage UEFI Secure Boot keys

Commands:
    create  Generate new UEFI Secure Boot keys
    enroll  Enroll new UEFI Secure Boot keys to your UEFI firmware
            (you have to clear old keys in your UEFI firmware setup utility first)
    sign    Sign EFI boot image file with your UEFI Secure Boot keys
    verify  Verify signature of EFI boot image file with your UEFI Secure Boot keys
    list    List all UEFI Secure Boot keys enrolled in your UEFI firmware
    status  Check if UEFI Secure Boot is active or inactive

Default configuration (/etc/cryptboot.conf)

# Encrypted boot device name (/dev/mapper/$BOOT_CRYPT_NAME)
# (have to be specified in /etc/crypttab)
BOOT_CRYPT_NAME="cryptboot"

# Boot partition mount point (have to be specified in /etc/fstab)
BOOT_DIR="/boot"

# EFI System partition mount point (have to be specified in /etc/fstab)
EFI_DIR="/boot/efi"

# Default boot loader (only GRUB is supported for now)
BOOT_LOADER="GRUB"

# Boot entry in UEFI Boot Manager (if using GRUB boot loader)
EFI_ID_GRUB="GRUB"

# Path to GRUB boot loader EFI file (relative to EFI System partition)
EFI_PATH_GRUB="EFI/grub/grubx64.efi"

# UEFI Secure Boot keys directory
EFI_KEYS_DIR="/boot/efikeys"

# Command run to upgrade system packages
PKG_UPGRADE_CMD="pacman -Syu"

Limitations