ZFS Encrypted RAID5 Array

J

jjthomas

I'm looking to set up (4) 1GB hard drives in a ZFS file system, encrypted. From what I've read, I need to setup the drives with encryption and then build the ZFS RAID system.

Is there a smart way to build an encrypted ZFS file system. I've found some information on a NAS, but most of what I have found, is mostly for an encrypted root installation. I do have FreeBSD running and encrypted ZFS on a 256G SSD. The RAID 5 array would be for just data.

Thank you.

-JJ
 
jjthomas said:
I'm looking to set up (4) 1GB hard drives in a ZFS file system, encrypted. From what I've read, I need to setup the drives with encryption and then build the ZFS RAID system.
Click to expand...
I stop reading your post here. You are mixing RAID and ZFS. ZFS is a combined file system and logical volume manager. You need Host Bus Adapter controller or just a motherboard with enough SATA connection to use ZFS. You don't use ZFS on the top of hardware or software RAID. Encrypting ZFS pool including root is trivial for example using PC-BSD installer or even vanilla FreeBSD installer which has some draw backs to PC-BSD at least when it comes to ZFS.

RAID stands for redundant array of inexpensive disks. There are two kinds of RAIDs (Hardware and Software). Traditionally BSD communities have strong preference for hardware RAID. Areca and LSI cards have been favourite for a long time. They are not cheap but you can buy a used Areca hardware RAID card for $10 on e-bay if you are lucky. You will use UFS on the top of hardware RAID. Traditionally BSDs have a weak support for software disciplines other than RAID 0, 1, and 10. I would not use FreeBSD on soft RAID 5, as a matter of fact I would never use RAID 5. Either use RAID 10 or RAID 6.

I have in my lab encrypted ZFS pools using FreeNAS 9.3 (it is trivial) as well as TrueOS (server version of PC-BSD). I also run hardware RAID with UFS on one of older servers which doesn't have enough muscles to run ZFS.

If you hardware is strong enough I would suggest using ZFS. Note that typical consumer grade desktop hardware is not good enough for ZFS IMHO (no arguing necessary do as you please).

Please update your post with the desired set up before we can help you more.
 
I got my terminology confused.

I would create a RAIDZ pool using /dev/ada1 /dev/ada2 /dev/ada3 /dev/ada4
zpool create STORAGE RAIDZ /dev/ada1 /dev/ada2 /dev/ada3 /dev/ada4
I want the whole pool encrypted.

Given the cost of hardware RAID controllers, I'm quite content with a software RAID solution.

My hardware is an Intel Core i7-3770K Quad-Core Processor 3.5 GHz, with 32G of RAM. No arguing, I'm still learning. :)

I've used RAID with Windows, SCO Unix and Linux. I'm struggling with the ZFS / zpool terminology. I've set up a few PC-BSD desktops, but I keep coming back to FreeBSD, though. I did setup FreeBSD on a RAID mirror. I've gotten a RAID (mirror) setup in FreeBSD, but I've never added an encrypted RAIDZ to an already running FreeBSD.

I've found how to encrypt a ZFS partition in Solaris, but was not able to find out how in FreeBSD.

Thank you.

-JJ
 
jjthomas said:
I got my terminology confused.

I would create a RAIDZ pool using /dev/ada1 /dev/ada2 /dev/ada3 /dev/ada4
zpool create STORAGE RAIDZ /dev/ada1 /dev/ada2 /dev/ada3 /dev/ada4
I want the whole pool encrypted.
Click to expand...

https://www.freebsd.org/doc/handbook/zfs.html
http://wiki.pcbsd.org/index.php/Disk_Selection_Screen/10.1

jjthomas said:
Given the cost of hardware RAID controllers, I'm quite content with a software RAID solution.

My hardware is an Intel Core i7-3770K Quad-Core Processor 3.5 GHz, with 32G of RAM. No arguing, I'm still learning. :)
Click to expand...
ZFS is not a software RAID. It is volume manager and file system in one. You have lots of RAM but is it ECC? Based on the processor that looks like a gaming/desktop rig to me. They usually come with non-ECC RAM modules..

jjthomas said:
I've used RAID with Windows, SCO Unix and Linux. I'm struggling with the ZFS / zpool terminology. I've set up a few PC-BSD desktops, but I keep coming back to FreeBSD, though.
Click to expand...
You have to read and understand https://www.freebsd.org/doc/handbook/zfs-zfs.html and man pages. I also like FreeNAS manual both for ZFS part and encryption explanation.

After you understand ZFS you should learn about Geli.

https://www.freebsd.org/doc/handbook/disks-encrypting.html

Then putting everything together this is the short summary from FreeNAS documentation

http://doc.freenas.org/9.3/freenas_storage.html#encryption

In another words. You encrypt HDD with Geli and then create zpool from encrypted HDDs after which you create datasets on the top of your pool as usual.
 
Oko said:
ZFS is not a software RAID.
Click to expand...
We have different definitions of "software RAID". A ZFS mirror or RAIDZ certainly is software RAID, in the definition of "software on the host computer doing the RAID functions, rather than firmware in a controller card".

But actually, all RAID is software RAID. The only thing that really varies is where that software runs.
 
What is ZFS?
ZFS is not just a volume manager and filesystem, it is also a disk multiplexer - a better term for 'RAID' since RAID0 is not redundant and JBOD/spanning/concatenating has just as much reason to be called RAID if RAID0 is permitted. All these storage schemes do is translate logical LBA to physical LBA across multiple disks, and add error correction (Mirror/Hamming/Parity) to improve effective Bit-Error-Rate.

But the storage schemes ZFS employs are strictly speaking no RAID, because no RAID engine could ever mimic what ZFS does. Because ZFS combines the filesystem with the disk multiplexer, it does not have to follow a static scheme like traditional RAID does, but rather improvise. The result is a dynamic stripesize for RAID-Z family, which is impossible for traditional RAID. The RAID engine has no knowledge about when the stripesize will be higher or lower - unless it will read the filesystem itself and try to figure it out. Thus, strictly speaking ZFS is not RAID.

But of course it falls in the software 'RAID' category.


Encryption and ZFS
Proprietary code exists to integrate encryption in ZFS, but is unusable due to its proprietary nature. But there are other options:
  • encrypt whole disks and give them to ZFS
  • encrypt disk partitions and give them to ZFS, this allows nice label names like 'gpt/SamsungDisk12.eli' where the .eli suffix is the decrypted version of the disk
  • use unencrypted pool but encrypt ZFS volumes instead, that are shared across the network with iSCSI
The latter is the most easy to accomplish, and does not require the whole pool to be encrypted at creation time, and be decrypted every time. You can encrypt and decrypt the ZVOL (ZFS volume) at any time, after shutting down iSCSI of course. Technically, you can also put another ZFS pool on the encrypted ZFS volume, but i'm not sure whether this kind of nested ZFS will run stable under stress.

Hope any of this is useful, good luck!
 
You must log in or register to reply here.
Back
Top