This is what I have written down to myself after trying what was then called Raspbian out a while ago:
- Go to: https://www.raspberrypi.org/downloads/raspberry-pi-os/
- Download the "Lite" ZIP file.
- Run Etcher ( https://www.balena.io/etcher/ ) and "burn" the "image" inside onto the flash card.
- Create the empty file "ssh" in the root dir for it to run the SSH server and thus enable me to access it.
- Put the flash card into the RPI and plug in to the network and power cables.
- As quickly as possible, before any bad actor can scan for my RPI and take it over, log in via SSH with the username "pi" and password "raspberry".
- Immediately change the password with passwd into something like this: f7oBELrqB8Xs7jO9sAgzH7TE6LCjgD6ccdCtHQNSQk2AsIsg2rc0IQga8
- The machine is supposedly installed.
But there is one important step missing: the one where it encrypts the whole thing, so that nobody can just locally steal my data (without extraordinary measures), and a password must be entered on boot with a temporarily attached USB keyboard.
I find nothing on this, to me, crucial and integral step. Applying encryption after installation appears to be a nightmare of separate commands, which I need to avoid at any cost. Please tell me that there is a "file trick" like with the "ssh" empty file in step 4, but for encryption? Maybe I can create a text file called "encrypt" and it simply contains the password which will be used and required? Please tell me that this is a thing.
I cannot use my RPI without encryption. It doesn't matter if it's much slower. I cannot order any extra hardware or enter a long list of manual commands. Please tell me that there is a simple step like above, or that a single command can now be run after the "installation" (if you can call it "installation" when the whole thing is apparently ready when the flash card goes into the RPI) to encrypt the system? If this is not possible, or so cumbersome as to not be done in practice, my entire plan for my RPI and myself is ruined.
Please don't link me to a tutorial with many steps and ads. I've already seen those. I'm looking for an elegant, supported, built-in solution.
I frankly can't understand who would ever want to run an unencrypted machine of any kind, no matter what it's used for. This seems like such a basic security measure to me that it feels irresponsible to everyone it would affect to not have this done.