version 2.46
This bash script auto-sets up and installs a LUKS Full Disk Encryption (FDE) system together with a Debian 13 desktop to your disk with minimal intervention. You only have to choose the security mode, root and swap partition size, desktop environment, and username to get a completely working system from scratch.
Designed for the average user with some Linux experience who doesn't want the hassle of manually creating a secure LUKS FDE system in the terminal.
Standard LUKS FDE on typical linux distributions take the approach of encrypting the OS partitions (root, swap and home) but not the boot partition. For some users though this might not be secure enough. But there is a problem. What is the best way to protect a system without making everyday use too inconvenient?
Securing a system always comes with trade-offs. This script aims to provide the user with a choice between the two most effective modes for secure everyday use, depending on their threat scenario.
The structure of the FDE system can be built according to two modes: 'Single Password' mode and 'USB keyfile' mode.
Single Password:
- Main Disk: Boot partition LUKS encrypted, with a password used to unlock the embedded keyfile for the LVM volume.
- Main Disk: LUKS encrypted LVM volume containing root, swap and home.
USB keyfile:
- USB Stick: EFI/BIOS and boot partitions with embedded keyfile (all unencrypted) used to unlock main disk
- Main Disk: LUKS encrypted LVM volume containing separate root, swap and home
- Keyfile: Stored on USB, used to unlock main disk without typing a password
Carefully assess which security setup works best for you. If typing a secure password on every boot is bothersome to you, the 'USB keyfile' mode is recommended. If physical security is a major threat, the 'Single Password' mode would be a better choice.
Using both Secure Boot and TPM in the boot chain will give you the strongest security but will also give you more complexity. And there is also the question of can you trust the UEFI/BIOS? The firmware is not open-source, so what is in it? Which is why these methods were excluded from this build. The ideal setup is to run LUKS FDE on an open-source firmware device (eg. Coreboot) with Secure Boot and TPM validating boot.
Read this wiki for a deeper analysis of various FDE models:
https://wiki.archlinux.org/title/Dm-crypt/Encrypting_an_entire_system#Overview
'Single Password' mode:
- Password only required once at boot
- A keyfile protects the LVM volumes (no 2nd password)
- Entire disk is essentially encrypted, except for the EFI/BIOS
'USB keyfile' mode:
- System CANNOT boot without the USB stick
- There is no password typing on startup, enabling a fast boot time
- EFI/BIOS and boot directories are physically seperated from the main disk
- Only the encrypted LVM remains on internal disk
Both modes include:
- Separate /root, /swap and /home LVM volumes for simpler upgrades
- Choice of auto-installed minimal desktop environments
- Support for both UEFI and legacy BIOS systems
A very lean set of packages are installed to get your desktop up and running on first boot. No uneccessary fluff. Or, if you prefer, you can preseed your own custom packages. Feel free to modify the script, and add or delete packages as you wish. These desktop environments are available during the build process:
- KDE Plasma
- Gnome
- Mate
- XFCE
These choices are offered at the start:
- Fresh FDE install (fresh layout with ALL existing data removed)
- Re-install FDE (keeping existing keyslots and partition structure)
- Modify existing LUKS keyslots only (keeping existing data).
These options were added to make LUKS FDE systems easier to manage over time without finiky manual intervention.
Script can only be built from Debian-based linux desktop environments. Other linux derivatives such as Arch, Fedora or Manjaro are not supported - since a Debian desktop will be installed. Additionally:
- Only x64 systems are supported (no legacy x32 architecture).
- ATA/SSD disk: An SSD is strongly recommended to counter the runtime encryption overhead
- One USB for the keyfile (at least 2GB)
- One USB for the bootable live USB OS
Installing will destroy ALL the existing data on the disk so remember to backup any important data before starting!
- First flash your favorite bootable live USB OS to the USB stick (e.g. Linux Mint)
- Boot into live environment and download the script.
- Make executable, run the script and follow the prompts:
chmod +x debian13-fde-auto-setup-v2x.sh
sudo ./debian13-fde-auto-setup-v2x.sh- Reboot once set up completes.
- LOCALE: en_US
- USERNAME: (set by user)
- PASSWORD: (set by user)
- ROOT: (set by user)
Aim to generate passwords with at least 80 bits of entropy.
- The password is the critical security factor so use a strong password: https://www.strongdm.com/blog/nist-password-guidelines
- Keyfile Backup: Store multiple backups of the USB keyfile in secure locations. Create direct block copies (use DD). One USB backup is not enough.
- Header Backup: Store securely OFFLINE with restricted permissions (for emergency recovery)
- USB Protection: The USB keyfile stick is a critical component - protect it physically like real keys. Don't get lazy and leave the USB in the device when not in use!
- Optional: To speed up boot time optimize initramfs size by loading only the modules for your hardware (sudo sed -i 's/MODULES=most/MODULES=dep' /etc/initramfs-tools/initramfs.conf && sudo update-initramfs -u -k all)
- Optional: Consider using AIDE (Advanced Intrusion Detection Environment) to monitor EFI/BIOS boot files integrity
- For troubleshooting you can find the log file at: /var/log/debian-fde-setup.log
- System upgrade: After every kernel change you should update the initramfs and grub before rebooting, otherwise your system could lock you out.
Please review the LUKS FDE Auto-setup bash script carefully. NEVER run a script blindly without understanding what it could do. Don't trust me. Google around to find out more. Please research, research, research.
Please note that by downloading and running this bash script you acknowledge that I am not responsible or liable for any damages or losses arising from your use or inability to use the script and or software used under this script. You are solely responsible for your use of this script. If you harm someone or get into a dispute with a 3rd party, you consent to me waiving any involvement.