Just had an interesting question from a colleague who has a #linux notebook and works remotely from random places:
> I've got full-disk #encryption (FDE), what else I can do for #security ?
@kravietz Set a grub password!
Use OpenSCAP Workbench with the proper profile for Ubuntu, Fedora or CentOS to check compliance.
Full set of instructions (one might want to select just a few, but still):
I guess that should already help a lot :)
@sheogorath But will Grub password protect from evil maid attacks such as this one? https://github.com/nyxxxie/de-LUKS
Because the main problem is that in Ubuntu the bootloader is loaded from an unencrypted partition, which can be modified off-line...
@kravietz
This is really something to be worried about, I have my partitions encrypted by LUKS :(
@sheogorath
