i believe a much better secure layer is something similar to what Novacustoms, Purism attempt to do: verify if somebody else not you try to access the laptop.
You’re thinking of Heads, which I agree is ideal for supported motherboards.
tang
Thanks. TIL about Clevis/Tang.
Yes. Here are some common self-hosting scenarios:
In all those cases, full disk encryption (FDE) is a sensible precaution to protect the data in case the server is physically stolen.
Linux is probably the most common OS kernel for self-hosting. On Linux, LUKS (Linux Unified Key Setup) is probably the best FDE system. It’s mature and reliable. But anyone self-hosting a Linux server with LUKS FDE is faced with the question of where to store the keys.
Hardware security tokens (HSTs) are widely considered a safer place for keys than SSDs, HDDs, or USB storage. They follow the smartcard principle: a private key can be written to an HST but not read from it (security vulnerabilities excepted). Instead, they implement cryptographic algorithms to prove possession of the private key. So, anyone self-hosting a Linux server with LUKS FDE should strongly consider storing their private key(s) on an HST.
However, there is more than one way to do that. Hence the question in my OP.
Crossposted from https://thebrainbin.org/m/linux@lemmy.ml/t/1840283
Which approach do you think is better, and why?
Or do you think there is an even better way to use a hardware security token to unlock drives having LUKS full disk encryption?
Which approach do you think is better, and why?
Or do you think there is an even better way to use a hardware security token to unlock drives having LUKS full disk encryption?
Trying to install ptouch-print:
$ git clone https://git.familie-radermacher.ch/linux/ptouch-print.git
Cloning into 'ptouch-print'...
Fetching objects: 794, done.
$ cd ptouch-print/
$ ./compile.sh
Found GD: NO
CMake Error at cmake/FindGD.cmake:109 (MESSAGE):
Could not find GD library
Call Stack (most recent call first):
CMakeLists.txt:13 (find_package)
-- Configuring incomplete, errors occurred!
So I thought maybe libgd was not installed, but it is, so where am I going wrong?
$ apt list --installed | grep libgd3
libgd3/noble,now 2.3.3-9ubuntu5 amd64 [installed]
Depends on use-case. If you only plan to boot it when you’re physically present, it’s fine.