Context
Hello. I’m new to Fedora and Silverblue, but not new to Linux. In the past, I’ve used LUKS for block level encryption.
However, today’s project is different. I’m setting up a laptop for my parents, who have a very low threat model. The laptop never leaves home and normally it’s stored away somewhere out of sight. At most they use their laptop once per month.
I created 3 separate user accounts, me and both of my parents. They do have some files stored locally, but nothing critical. I’d like to keep the 3 account setup.
They’re coming from macOS which only requires users to enter their password in once. I’d like to keep this property in order to not make using the computer more difficult or annoying.
At first, I was going to not use any encryption at all, since this would make it the most easy for them to operate the laptop. However, I thought maybe I could do a little better. Starting from here, I’d like to increase security as much as possible—without them noticing or making it more annoying to use the laptop.
Questions
One thing I thought I could do is use eCryptfs to encrypt their home directories. Is this possible in Silverblue? I didn’t see this option in the installer. I’ve never used eCryptfs before.
Can I or should I enable Secure Boot on the laptop? Currently, it’s off and I haven’t used a Linux distro where I could turn it on before. But I thought I saw somewhere that Silverblue might work with Secure Boot? I tried turning it on, but then the OS didn’t boot.
What about TPM auto-unlocking a LUKS encrypted drive? Is this supported in Silverblue? I thought I read it kinda works, but it’ not very secure? But, I would take a 1% increase in security over nothing. (Again, my case doesn’t require high security.) Or is it not supported at all? Would an update break the auto-unlocking, preventing the laptop from booting? Could I combine this with eCryptfs home directory encryption?
A final option I thought about was to use 3 keyslots in LUKS, with each user account’s password. Then somehow configure GDM so that it displays a list of the 3 users and my parents would just click on their name—but not have to enter their password to log into their account. (Doesn’t matter if my mom enters my dad’s account after LUKS is unlocked.)
Update:
Wait, is eCryptfs deprecated?
!
