[Full disk encryption] Prompt to unlock with lid closed on external screen

Framework Laptop 13 Linux
1

Hello.

I’m using a FW13 11th Gen Intel with Void Linux + XFCE. Until now I didn’t encrypt my disk (which is bothering me a bit considering I am using it also for work and traveling sometimes). As I am changing my SSD, I wanted to encrypt the full disk.
However at home, the laptop is closed and connected to a USB C docking station with a screen connected to the 1st HDMI port of the dock.
Setup is working fine for now but I am not able to have anything displayed on the external screen before the login so I am wondering if it’s possible to get the prompt to unlock the disk displayed on the external screen.

2

Hi

I think this is dependent on BIOS support.
I have seen reports it works on gen 12, but I don’t know about other versions.
For example, on gen 12 you can see the bios screens on external monitors.
It does not work on my FW16 AMD for example.

3

Thanks for the feedback!
I’ll have a look at the BIOS options and (out of curiosity) also with the external screen directly connected with USB C to the laptop (I don’t have an HDMI expansion card).

4

You could also try not-quite FDE using LUKS. In that case I don’t believe the collection and processing of the unlock pass-phrase is handled by the BIOS (but I could be mistaken).

Here’s what my LUKS-encrypted NVMe looks like:

nvme0n1          259:0    0 465.8G  0 disk  
├─nvme0n1p1      259:1    0   768M  0 part  
│ └─boot_crypt   252:6    0   766M  0 crypt /boot
├─nvme0n1p2      259:2    0     2M  0 part  
├─nvme0n1p3      259:3    0   128M  0 part  /boot/efi
└─nvme0n1p5      259:4    0 464.9G  0 part  
  └─lvm2_crypt   252:0    0 464.9G  0 crypt 
    ├─sysvg-swap 252:1    0    36G  0 lvm   [SWAP]
    ├─sysvg-root 252:2    0    24G  0 lvm   /
    ├─sysvg-var  252:3    0    16G  0 lvm   /var
    ├─sysvg-home 252:4    0    48G  0 lvm   /home
    └─sysvg-vbox 252:5    0   336G  0 lvm   /mnt/vbox

Dino

5

Thanks!
In the end, I went the unencrypted road (as before) for the moment.
As I have a separate root partition, I’ll take some time to see how to encrypt my other partitions.