{ "id": "CB-UBU-FS-012", "standard": "ubuntu", "version": "0.1.2", "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-FS-012", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-FS-012.json", "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-FS-012.yml", "profiles_effective": [ "desktop-hardened" ], "license": "Text CC BY 4.0, code Apache-2.0", "attribution": "CIRSEC Baselines, https://baselines.cirsec.org", "control": { "id": "CB-UBU-FS-012", "title": "Encrypt the disks holding the system and data", "finding": { "title": "File systems or swap are stored unencrypted on disk", "description": "Anyone holding the disk or the device, lost, stolen or discarded, can read its data and change the system offline." }, "status": "active", "profiles": [ "desktop-hardened" ], "risk": { "severity": "medium" }, "assessment": "automated", "tags": [ "encryption", "luks", "physical-access" ], "description": "With LUKS (dm-crypt), each partition or LVM volume group is encrypted with a key unlocked at\nboot, by a passphrase, a TPM or a key server. The Ubuntu installers set it up when asked: the\ndesktop installer with its LVM and encryption option (or, from 23.10, the experimental\nTPM-backed encryption), the server installer by encrypting the LVM volume group in the guided\nstorage layout. Only `/boot` and the EFI system partition stay in clear text.\n", "rationale": "Laptops and workstations are lost and stolen, and disks leave with returned or discarded\nhardware. Without encryption, the data, the password hashes and the keys on the disk can be\nread, and the system can be modified offline (for example to plant a backdoor) without any\ntrace.\n", "impact": "A passphrase must be typed at every boot, unless a TPM or network unlock is set up, which makes\nunattended reboots harder. Encrypting an existing system requires a reinstallation or an\noffline conversion. Performance cost is negligible on CPUs with AES instructions.\n", "notes": "The check covers every mounted ext2/3/4, XFS, Btrfs, F2FS and JFS file system except `/boot`\nand below, and every swap partition or swap file; zram swap is in memory and skipped. A device\nthat is not a block device (ZFS dataset, network file system) makes the check report an error,\nto be reviewed by hand.\n\nUbuntu desktops swap to `/swap.img` on the root file system, which is therefore encrypted with\nit. TPM-backed encryption also uses LUKS2 volumes, so the check accepts it the same way.\n", "setting": { "location": "Disk layout, /etc/crypttab", "default_value": "Unencrypted unless chosen in the installer", "recommended_value": "Every file system except /boot, and swap, on a dm-crypt device" }, "audit": { "manual": "Run `lsblk -o NAME,TYPE,FSTYPE,MOUNTPOINTS`. Every mounted file system except `/boot` and\n`/boot/efi`, and every swap, must sit below a device of type `crypt`.\n", "checks": [ { "id": "crypt", "engine": "shell", "description": "dm-crypt below each mounted disk file system and swap.", "spec": { "script": "rc=0 n=0\nlist=$(findmnt -rn -o SOURCE,TARGET -t ext2,ext3,ext4,xfs,btrfs,f2fs,jfs\n swapon --noheadings --show=NAME,TYPE 2>/dev/null | while read -r name type; do\n case $type in\n partition) echo \"$name swap\" ;;\n file) echo \"$(findmnt -n -o SOURCE -T \"$name\") swap:$name\" ;;\n esac\n done)\nwhile read -r src target; do\n [ -n \"$src\" ] || continue\n case $target in /boot | /boot/*) continue ;; esac\n case $src in /dev/zram*) continue ;; esac\n dev=${src%%\\[*}\n n=$((n + 1))\n if ! t=$(lsblk -nso TYPE \"$dev\" 2>/dev/null); then\n echo \"$target on $src: not a block device, check by hand\"\n [ \"$rc\" = 1 ] || rc=3\n elif ! printf '%s\\n' \"$t\" | grep -qx crypt; then\n echo \"$target on $src: not encrypted\"\n rc=1\n fi\ndone <