this post was submitted on 29 Feb 2024
23 points (92.6% liked)
Linux
48224 readers
111 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Should the LVM partition layout considered as metadata leak in LUKS over LVM?
Yes
Should I worried about it?
Probably not. The metadata it leaks will be the name of the volumes, their sizes and possibly used space on them.
It really depends on your use case. If you're only using one key, I'd put LVM on top of LUKS just for the simplicity. Otherwise it becomes a threat model analysis: if someone steals your computer or drive, do you care that they know you have 5 volumes on them and roughly how much data is on there?
I need my desktop to boot unattended, and it's got 5 drives in it, so it made sense for me to have separate encryption. It boots and does its NAS duties on its own, then when I log in a dedicated dataset gets mounted for me with all my data on it. From there I might unlock some volumes for work by getting their key from an AWS Secrets Manager endpoint. My laptop is plain f2fs over LUKS.
I'm planning FDE on my laptop which have 2 drives. I originally plan to use LUKS on LVM as I can use LVM to join two drives into one. But now I wonders if my choice is right.
That works too, if you have a use case go for it. There's so many valid ways to arrange your disks.
LUKS over LVM over 2 disks is as valid as LVM over 2x LUKS which is as valid as LVM over LUKS over RAID1. Although with multiple disks I'd probably go with filesystem mirroring with btrfs or ZFS, and give it the two LUKS volumes. That way you get per file chunk checksums and self healing if your drives start to drift off (RAID won't tell you if either disk returns garbage, and has no way of telling which disk has the correct data).
But really, I wouldn't worry about LVM metadata unless you're holding some seriously sensitive and valuable data. I can't think of a use case where LVM metadata would be bad but not LUKS headers. Like the only information really leaking is the name of the volume and how big it is, so unless you happen to have a dedicated volume full of secret documents of a known size and that can be used as evidence of you being in possession based on the size alone, it's kinda eh.
So you mean BTRFS over LUKS? I will have a try on a VM later, plus the ZFS too. Thanks for the advice.