I recently switched to Linux (Zorin OS) and I selected “use ZFS and encrypt” during installation. Now before I can log in it asks me “please unlock disk keystore-rpool” and I have to type in the encryption password it before I’m able to get to the login screen.
Is there a way to do this automatically like with Windows or MacOS? Zorin has biometric login which is nice but this defeats the purpose especially because the encryption password is long and tedious to type in.
Also might TPM have anything to do with this?
EDIT: Based on the responses I have to assume some of you guys live in windowless underground bunkers sealed off with concrete because door locks “aren’t secure against battering rams”. Normal people don’t need perfect encryption they just want to add an extra hurdle or two for the crackhead who steals the PC. I assumed Linux had a system similar to what Windows or MacOS has been doing for a decade but I am apparently wrong.
What it sounds like you want is only your home folder encrypted, where it decrypts seamlessly upon login. It sounds like you have encrypted OS root, which is more secure but necessarily requires a password before the system gets to the login screen.
Other than reinstalling your system, you do have the option of either making your decryption password shorter, and/or enabling auto-login after boot (if you’re the computer’s only user), so you’d only have to type one password instead of two.
Auto-Login makes the most sense I didn’t consider that. I’ll just have to be careful not to log out without shutting down.
I chose to use auto login for my PC. This way I’m only using my password to decrypt the drive after a reboot or the login screen after waking ffrom sleep.
Or you can do full disk encryption and store the encryption info in the TPM and lock it down against various PCRs such that changes to the boot order or firmware prevent the drive unlocking without a secondary decryption key, just like Windows and Macs do.
It’s a built in feature of systemd, among other tools.
I’m not familiar with exactly what you mean, does it not require a password to boot that way? I have full-disk encryption on my laptop but not with TPM, grub just prompts me for a password before the kernel boots
Correct. The decryption key is stored in the TPM and unsealed when specific criteria match (for example, booted from the correct drive, to the correct kernel file). Figuring out the correct values to tie it to is probably the worst part for a user, if you do it wrong it might just unseal because your EFI firmware binary hasn’t changed, which isn’t all that useful if someone is trying to break in with a live image.