LUKS ask for passphrase after waking up from sleep

[luckylinux]

Until now I always encrypted my whole / (with a separated unencrypted /boot) partition, however since I almost always put my computer to sleep instead of turning it off, encryption seems to be uneffective.


The reason for this is that if someone steals my PC and doesn't reboot it (or the battery dies), they will have access to all of my data - if they manage to login on the computer (which IMHO can be prevented by something like grsecurity or putting a maximum # of login attemps before locking the system - or rebooting it) - they would be able to see all of my data and settings.

I see now there is an alternative that may be able to solve this problem but would require a few additionnal configuration (editing the init scripts, ...): "luksSuspend" / "luksResume". I would therefore need to leave unencrypted the following directories:

• /boot (expecially if using GPT)
  
• /
  
• /sbin (for cryptsetup)
  

I don't know if other directories should also left unencrypted. Since all init scripts are in /etc/rc.d, maybe they should as well be left unencrypted but that's a BIG security risk (/etc usually contains all networking passwords like VPN's, maybe other devices' encryption keys, ...). Not sure if a random-key encrypted swap would pose a problem (probably it does).


Did anyone of you try to implement luksSuspend / luksResume? How did you do that?
Or are there others alternatives?

Remark: I'm looking to implement suspend to ram (also known as "sleep" / "standby mode" / "suspend") with encryption support. I'm NOT looking to implement suspend to disk (also known as "hibernate"). Since almost all of my PCs run on SSDs swap would be nonsense. For a desktop I may as well put a HDD dedicated for swap, but with 16GB+ RAM I don't think I'll ever need it (but who knows ).

Edit: I'd also like to be able to mount my encrypted partition(s) over SSH (using the Dropbear trick into the initramfs image)

[rufnut]