While I’m trying to get Encrypted /boot and a detached LUKS header on USB to work,
I had a couple of questions come to mind:
1. Does the backup USB key need to be updated?
2. If so, then how would someone keep all backups up to date?
I probably asked a dumb question but if anyone can help guide me through the steps I’d really appreciate you!🤗🌻
Yes that is true, but if you’re using a detached LUKS (prob LUKS2) header then the USB drive isn’t your boot partition and the file system type won’t matter as much for that than the order of kernel modules loaded before boot.
Using a detached LUKS header appealed to me at the time because it has most of the same benefits as an encrypted boot partition like available with GRUB and GRUB at the time still only supported the first version of LUKS. Plus I was pretty confident in my ability to securely back up my LUKS header, so that if I traveled then I could grab a copy of the header remotely if the USB drive was somehow compromised. That way you can travel and not have to worry about your laptop or whatever revealing as much information about your FDE setup vs. if the LUKS header is on the internal drive, it still provides details about the encryption.