How do I encrypt TUXEDO OS during installation? - TUXEDO Computers

In this article we will show you how to encrypt TUXEDO OS during installation. You can find out what you need to know about encryption if ordered with the device or with WebFAI in a separate article in our knowledge base.

TUXEDO OS in its latest version offers you the option of encrypting your installation when you start the installer. We use LUKS2, the standard procedure for hard disc encryption under Linux. In contrast to an earlier implementation, this only works with TUXEDO OS on the SSD and no longer in dual boot. If you want to encrypt TUXEDO OS and another Linux distribution or TUXEDO OS Windows, you will need another separate SSD or have to partition manually. All methods work equally well under X11 and Wayland.

The practice

Firstly, download the ISO with TUXEDO OS from our download portal. A separate article from our knowledge base explains how to write the downloaded ISO image onto a USB stick and start your notebook with it.

Once TUXEDO OS has started, first set the language and keyboard layout. You will then be taken to the desktop, where you will find the icon for the installer in the top left-hand corner. When you start the installer, you will first be asked whether you want to encrypt your system. Read through the details first. If you agree, click on Encrypted installation.

If there is more than one data carrier in the system, select the one intended for the encrypted installation.

In the next step, you must confirm that you want to delete the only disk or the disk selected in the previous step in order to perform an encrypted installation of TUXEDO OS on it.

You will then see the partitions to be created. If you agree with the partitioning and with ext4 as the file system, accept the proposal and continue.

If you want to change the file system, you can choose between the btrfs or xfs file systems by clicking on Change file system.

After you have accepted the partitioning, the system will ask you for the password for the encryption, which you must then enter a second time. Please pick a long password with special characters to protect your data in the best possible way, even if the notebook is lost or stolen.

After you have repeated the encryption password, the installation starts with the creation and formatting of the partitions, followed by the normal installation with the Calamares installer familiar from TUXEDO OS.

After the subsequent restart and entering your encryption password, TUXEDO OS will open, and you can set up your new system.

Dual boot on a single data carrier

If you want to install another distribution or Windows as a dual boot on a data carrier in addition to TUXEDO OS, you will have to do the partitioning in the installer yourself. We will soon describe how this works in a separate article.

In the context of encryption, we are often asked whether an already installed TUXEDO OS can be subsequently encrypted. Although this is possible with Windows and Linux, it is not a task for beginners. However, you can back up your home directory and other important data and then insert it into a newly installed encrypted system.