Locking down a linux machine is getting easier by the day. Recent advancements in systemd-boot have enabled a host of features to help users ensure that their machines have not been tampered with. This guide provides a walkthrough of how to turn on many of these features during installation, as well as reasoning for why certain features help improve security.

The steps laid out below draw on a wide variety of existing resources, and in places I'll point to them rather than attempt to regurgitate full explanations of the various security components. The most significant one, which I highly encourage everyone to read, is Rod Smith's site about secure boot, which is the most comprehensive and cogent explanation of UEFI, boot managers and boot loaders, and secure boot. Another incredibly useful resources is Safeboot, which encapsulates many of the setup steps below in a Debian application.

Disclaimer: Use this guide at your own discretion. The author is not responsible for any data loss or security breaches that may occur. Always ensure you understand each step and its implications before proceeding.

This guide walks you through setting up a secure external drive, perfect for backing up sensitive data, securely handing over large data sets, or storing important files. It covers creating an encrypted drive that’s easy to unlock with trusted devices, such as a security key, while remaining highly secure if misplaced. Ideal for safeguarding personal data or business files, it offers practical recovery steps to ensure access even if you change devices.

By following this guide, you will have established a secure and user-friendly encrypted storage solution that leverages:

• LUKS2 Encryption: Provides robust disk encryption.
• TPM2 Integration: Enables automatic unlocking on trusted hardware.
• FIDO2 Tokens: Offers flexible acc

4242424242424242 Visa

4012888888881881 Visa

4000056655665556 Visa (debit)

sudo apt install zsh-autosuggestions zsh-syntax-highlighting zsh