# yaml-language-server: $schema=../../../../schema/control.schema.json id: CB-DEB-FS-012 title: Encrypt the disks holding the system and data finding: title: File systems or swap are stored unencrypted on disk description: Anyone holding the disk or the device, lost, stolen or discarded, can read its data and change the system offline. status: active profiles: [desktop-hardened] risk: severity: medium assessment: automated tags: [encryption, luks, physical-access] description: | With LUKS (dm-crypt), each partition or LVM volume group is encrypted with a key unlocked at boot, by a passphrase, a TPM or a key server. The Debian installer sets it up with the "Guided - use entire disk and set up encrypted LVM" partitioning method. Only `/boot` and the EFI system partition stay in clear text. rationale: | Laptops and workstations are lost and stolen, and disks leave with returned or discarded hardware. Without encryption, the data, the password hashes and the keys on the disk can be read, and the system can be modified offline (for example to plant a backdoor) without any trace. impact: | A passphrase must be typed at every boot, unless a TPM or network unlock is set up, which makes unattended reboots harder. Encrypting an existing system requires a reinstallation or an offline conversion. Performance cost is negligible on CPUs with AES instructions. notes: | The check covers every mounted ext2/3/4, XFS, Btrfs, F2FS and JFS file system except `/boot` and below, and every swap partition or swap file; zram swap is in memory and skipped. A device that is not a block device (ZFS dataset, network file system) makes the check report an error, to be reviewed by hand. setting: location: Disk layout, /etc/crypttab default_value: Unencrypted unless chosen in the installer recommended_value: Every file system except /boot, and swap, on a dm-crypt device audit: manual: | Run `lsblk -o NAME,TYPE,FSTYPE,MOUNTPOINTS`. Every mounted file system except `/boot` and `/boot/efi`, and every swap, must sit below a device of type `crypt`. checks: - id: crypt engine: shell description: dm-crypt below each mounted disk file system and swap. spec: script: | rc=0 n=0 list=$(findmnt -rn -o SOURCE,TARGET -t ext2,ext3,ext4,xfs,btrfs,f2fs,jfs swapon --noheadings --show=NAME,TYPE 2>/dev/null | while read -r name type; do case $type in partition) echo "$name swap" ;; file) echo "$(findmnt -n -o SOURCE -T "$name") swap:$name" ;; esac done) while read -r src target; do [ -n "$src" ] || continue case $target in /boot | /boot/*) continue ;; esac case $src in /dev/zram*) continue ;; esac dev=${src%%\[*} n=$((n + 1)) if ! t=$(lsblk -nso TYPE "$dev" 2>/dev/null); then echo "$target on $src: not a block device, check by hand" [ "$rc" = 1 ] || rc=3 elif ! printf '%s\n' "$t" | grep -qx crypt; then echo "$target on $src: not encrypted" rc=1 fi done <