Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been looking at system encryption with ArchLinux and i think I have it pretty much figured out but I have a question about the /boot partition. Once the system is booted up is it possible to unmount the /boot partition and allow the system to continue to run?

My thought was to install /boot to a USB stick since it can't be left encrypted and then boot from the USB stick which would boot up the encrypted hard disk. Then I can take the USB key out and just use the system as normal.

The reason I want to do this is because if an attacker was able to get physical access to the machine they could modify the /boot partition with a keystroke logger and steal the key and if they already had a copy of the encrypted data they could just sit back and wait for the key. I guess I could come up with a system of verifying that the boot has been untouched at each startup.

Has this been done before? Any guidance for implementing it on my own?

share|improve this question

Yes, it is possible and even recommended if you encrypt the drive.

The only thing you have to remember is to connect it when you do kernel upgrades. The rest is straightforward, you partition the USB stick, install GRUB (or LILO) on it, set the /boot partion as bootable use UUID or LABEL in the root= parameter in bootloader config and you should have a working solution.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .