been trying to setup automatic unlock using a usb drive, and found a slightly better method describe

been trying to setup automatic unlock using a usb drive, and found a slightly better method described here: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening turns out Bazzite already comes included with clevis out of the box, will try this out and see how it goes

Red Hat Customer Portal

Chapter 11. Configuring automated unlocking of encrypted volumes by...

Access Red Hat’s knowledge, guidance, and support through your subscription.

DevilFish303OP•3/25/24, 1:19 AM

im using Rocky Linux 8.9, but kinda hate how the default user created is not in wheel and root account has to be activated, i don't really like having root accounts active, anybody know what's a good RHEL distro for minimal server these days?

DevilFish303OP•3/25/24, 1:20 AM

the server is going to be a small server that sits somewhere in my network that will host tang

SShiina IDK I'm asking in general because I might just use my quest 2 as the display of ...

59smoke•3/25/24, 1:25 AM

Yeah just do this

SouthMoth•3/25/24, 1:31 AM

Is there a con to having secure boot permanently disabled? Only reason i ask is because i recently had a weird issue where my pc wouldnt boot up at all after doing a hard reset. No bios no bazzite just no image coming from hdmi. Unplugged and plugged back in the power and i was given a load the kernel first message so i disabled secure boot and its all fine now. Is there any risk of having secure boot off forever?

Kyle Gospo•3/25/24, 1:31 AM

https://steamdeckhq.com/news/bazzite-2-4-0-update-fixes-suspend-issues/

Steam Deck HQNoah Kupetsky

Bazzite 2.4.0 Update Fixes Suspend Issues on Ally and Go and Adds H...

Bazzite's 2.4.0 update has arrived, and it includes some great additions and fixes for Steam Deck, ROG Ally, and Legion Go!

SSouthMoth Is there a con to having secure boot permanently disabled? Only reason i ask is ...

tryhardsoccermomswag•3/25/24, 1:32 AM

you didn't enroll our key

Ttryhardsoccermomswag you didn't enroll our key

Kyle Gospo•3/25/24, 1:32 AM

not if they didn't get a bios

tryhardsoccermomswag•3/25/24, 1:32 AM

you could enroll it and turn secure boot back on

Kyle Gospo•3/25/24, 1:32 AM

separate issue

tryhardsoccermomswag•3/25/24, 1:32 AM

what

tryhardsoccermomswag•3/25/24, 1:32 AM

eh, honestly imo, secure boot isn't even worth having on a desktop anyways

tryhardsoccermomswag•3/25/24, 1:32 AM

im not a security expert by any means though

Ttryhardsoccermomswag you didn't enroll our key

SouthMoth•3/25/24, 1:32 AM

I did tho. Thats how i was fine for the past few weeks up until today. Then this happened and i got the kernel message so i disabled secure boot and was fine afterwards

tryhardsoccermomswag•3/25/24, 1:33 AM

alright sorry for the assumption

tryhardsoccermomswag•3/25/24, 1:33 AM

i still stand by not caring to have secure boot turned on personally

Ttryhardsoccermomswag eh, honestly imo, secure boot isn't even worth having on a desktop anyways

DevilFish303OP•3/25/24, 1:34 AM

im in the same camp, you have to be careful about enabling it and enrolling your own custom keys and removing microsoft keys, ive heard of people bricking their systems doing this on some boards. I'd buy a system76 system with coreboot at some point in the future just to get away from secureboot

SouthMoth•3/25/24, 1:34 AM

No worries lol. Yeah I figured itd be fine to have it disabled since the pc bazzite is installed to is essentially a console and nothing more. I dont use it ever for general browsing and other pc use.

tryhardsoccermomswag•3/25/24, 1:34 AM

my chromebook runs coreboot rn

SouthMoth•3/25/24, 1:34 AM

What does secure boot even do?

SSouthMoth What does secure boot even do?

DevilFish303OP•3/25/24, 1:35 AM

protects you against rootkits, which is malware at the bootloader level

DevilFish303OP•3/25/24, 1:35 AM

well... its supposed to do that

DDevilFish303 protects you against rootkits, which is malware at the bootloader level

SouthMoth•3/25/24, 1:35 AM

How does one end up catching that? Downloading malicious files?

59smoke•3/25/24, 1:35 AM

but mostly a tool for microsoft to stop people from installing linux

DevilFish303OP•3/25/24, 1:35 AM

it became apparent it was just microsoft trying to lock PCs down

SSouthMoth How does one end up catching that? Downloading malicious files?

DevilFish303OP•3/25/24, 1:36 AM

that can be a way yes, malware just alters the bootloader so it always loads on boot and goes undetected by antivirus scanners, and sits on your computer, either logging everything you do, or punches holes in your network to allow bad actors to infiltrate

DDevilFish303 that can be a way yes, malware just alters the bootloader so it always loads on ...

SouthMoth•3/25/24, 1:37 AM

Interesting. Well fingers crossed that doesnt happen to me lol I just wanna game

DevilFish303OP•3/25/24, 1:37 AM

nah, just don't download things from shady places, which bazzite helps you do that

DevilFish303OP•3/25/24, 1:38 AM

you gotta go out of your way to install malware, the only way you can download anything bad is randomly downloading stuff from shady websites, or if official repos would be compromised, which i think they have contingencies for anyway

DevilFish303OP•3/25/24, 1:40 AM

the shadiest thing you can do on linux is install random things off the AUR tbh, on bazzite you need distrobox for that. The only thing distrobox would have access to is your home dir, not sure if it can even get your /usr directory, i don't think so

DDevilFish303 the shadiest thing you can do on linux is install random things off the AUR tbh,...

tryhardsoccermomswag•3/25/24, 1:40 AM

/usr/usr is read-only

Ttryhardsoccermomswag `/usr` is read-only

DevilFish303OP•3/25/24, 1:41 AM

ah right, even better haha, its why i went from fulltime EOS to Bazzite too, security is better for this and other reasons

DevilFish303OP•3/25/24, 1:41 AM

on Bazzite you get selinux out of the box too, which is one more layer to protect yourself, if all you do is download and play games from reputable places and keep your system up to date, there's nothing to worry about, just follow best safe practices

tryhardsoccermomswag•3/25/24, 1:42 AM

SELinux is so nice! saddens me when i hear people take it out of enforcing mode sometimes