[arca_vorago]

Not if grub is encrypted, better even behind FDE.

[justaj]

How does booting for remote login in such a setup work though? You'd have to be physically present in order to enter the passphrase.

[arca_vorago]

For that I do an ssh shim at initram (with portknocking) for key entry preboot

[amdavidson]

I would love to read a tutorial on that if you know of one.

[rthille]

https://hamy.io/post/0005/remote-unlocking-of-luks-encrypted...