Need help installing Proxmox with automatic decryption and multiple drives

[BeyondEvil]

Assuming you have auto-unlock enabled for your system, because that was the use case you described:
What would prevent an attacker for just overriding the boot argument with e.g. init=/bin/bash and booting right in your decrypted OS or just doing what your current initrd is doing and injecting what he wants? That is one of the known attack vectors in a physical access scenario. What about DMA-based attacks? Also very easy doable in the scenario with physical access. What about a cold-boot attack?

TPM should be used with additional authentication in order to mitigate those issues or you should offload the encrypted disk description to another machine so that an attacker with physical access will not be able to encrypt it.

Whatever man, if the crackhead that breaks in and steals my machine is able to use one of those attacks - he can have the family photos. He's earned them.

Now, if I were storing nuclear launch codes it'd be a different story.

 

[alexskysilk]

if the crackhead that breaks in and steals my machine is able to use one of those attacks - he can have the family photos.

Then why bother with the complexity in the first place...

 

[LnxBil]

Then why bother with the complexity in the first place...

My thought exactly.

 

[BeyondEvil]

Then why bother with the complexity in the first place...

That should be obvious, to learn. Further, I'm not giving away the photos etc. for free. If I can protect against 99.9999% of thieves, I will.