How can I set up TPM and secure boot for Linux like BitLocker?
Asked by
CuriousPineapple42
I've been trying out Linux on and off for a few years, but I've never fully switched due to gaming performance issues. I used to game on Windows with BitLocker enabled, which I believe uses TPM and secure boot for added security.
Recently, I decided to give CachyOS a shot, especially since gaming support on Linux seems to be improving thanks to Valve and Nvidia. During the installation, I enabled disk encryption (most likely with LUKS), but I really don't want to enter my long 32-character password every time I boot up. I'm looking for a way to implement something like BitLocker, using TPM and secure boot for hassle-free access while maintaining security.
Is there a straightforward method to achieve this in a Linux environment, or should I just avoid shutting down my PC and stick to sleep mode?
Answers
Absolutely! LUKS does support storing encryption keys in your TPM with tools like systemd-cryptenroll. Many Linux distros now support Secure Boot, but I’m not sure if CachyOS is one of them. Just remember that Secure Boot is not directly related to disk encryption; it’s more about secure startup.
Reply to this answer
Just to clarify, don't think of Linux in the same way as Windows when it comes to installation and running applications. If you stick to installing software from your distro's repository, your system should be safe. Addressing your concerns—if you're just gaming and not dealing with sensitive data, the need for measures like LUKS might be lower, especially if you're not worried about someone physically accessing your PC.
Reply to this answer
While I can't speak for Cachy specifically, I'm using Fedora with full disk encryption and TPM 2.0 for unlocking using systemd-cryptenroll. You can find details on the Arch Wiki for Arch-based systems, but for Fedora, I needed to enable the tpm2-tss kernel module and modify my cryptenroll settings. It’s definitely doable! Here are some links to set things up: ArchWiki: https://wiki.archlinux.org/title/Systemd-cryptenroll and a Fedora article: https://fedoramagazine.org/use-systemd-cryptenroll-with-fido-u2f-or-tpm2-to-decrypt-your-disk/.
Reply to this answer
For more information on transitioning to Linux, check out the migration page in our wiki or the tips available in our sticky posts. These resources can help make your switch smoother!
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions