Authenticated Boot and Disk Encryption on Linux
If your attacker is both sophisticated <i>and</i> able to access your hardware directly, the game <i>is</i> over; nothing we can do can currently avoid this.<p>What we can do is address the scenarios in which an attacker is either <i>unsophisticated</i> or <i>remote</i>.  Normal network security takes care of the latter case, and for unsophisticated attackers, a good FDE (Full Disk Encryption) system covers it nicely.  For laptops you can either live with typing in a password at every boot, or get a USB key of some kind.  For <i>servers</i> with FDE you might want to use something to enable remote and unattended reboots, like (shameless plug) Mandos¹.<p>1. <a href="https://www.recompile.se/mandos" rel="nofollow">https://www.recompile.se/mandos</a>