In the interests of protecting personal info in case a laptop gets stolen, I'm looking for the best way to encrypt a Linux system.
Disadvantages of whole disk encryption including swap:
- Pre-boot password prompt is kind of ugly and unpolished, appearing hidden amongst the boot messages (can something like Splashy handle this?)
- Need to log in twice (if you have a GDM login screen and need multiple users)
Disadvantages of individual folder encryption using libpam-mount or similar:
- Only the user's home folder is encrypted (whereas /etc, /var etc might contain sensitive information too).
- Swap file isn't encrypted, so likely to be leakage of sensitive data in there
- No way to securely hibernate.
I'm using Debian Linux if it matters. Doesn't need to be ridiculously secure, but want peace of mind that a thief cannot steal my identity, bank account details, VPN logins etc. if it is stolen while off/hibernating.
Do you know of ways to solve any of my above problems?