Hi,
First of all, the new bsdinstall(8) is great! Setting up a new system with ZFS and geli(8) is so simple.
So I'm trying this out in VirtualBox, the plan is to build a fully encrypted workstation with two ZFS mirrors (2xSSD and 2xHDD). I'm learning ZFS and GELI as I go.
During installation, creating the zroot encrypted mirror:
Post install, adding the second encrypted mirror:
Make sure /boot is mounted and view the contents of /boot/loader.conf:
Show partitions and devices:
Create a new GPT partitioning scheme on ada2 and ada3:
Create a new single ZFS partition on each device (will take up all the available space on each drive):
Initialize two new GELI providers, reusing the key file created during installation:
Attach the providers, enter the passphrase for each:
Create the new zpool mirror named "tank1":
Add the following new lines /boot/loader.conf:
Export bootpool (unmounting /boot):
And finally, reboot to see if everything is working:
During boot FreeBSD asks for the passphrase four times, as it should, and the new zpool "tank1" is mounted. So everything seems to be working.
Like I said in the beginning, I'm new to both ZFS and GELI. Am I doing this correctly? Is it a mistake to reuse the existing key file?
Thanks,
Mikael
First of all, the new bsdinstall(8) is great! Setting up a new system with ZFS and geli(8) is so simple.
So I'm trying this out in VirtualBox, the plan is to build a fully encrypted workstation with two ZFS mirrors (2xSSD and 2xHDD). I'm learning ZFS and GELI as I go.
During installation, creating the zroot encrypted mirror:
Code:
┌────────────────ZFS Configuration───────────────────â”
│ Configure Options: │
│ ┌────────────────────────────────────────────────┠│
│ │ >>> Install Proceed with Installation │ │
│ │ - Rescan Devices * │ │
│ │ - Disk Info * │ │
│ │ 1 Pool Name zroot │ │
│ │ 2 Disks To Use ada0 ada1 │ │
│ │ 3 ZFS VDev Type mirror │ │
│ │ 4 Force 4K Sectors? YES │ │
│ │ 5 Encrypt Disks? YES │ │
│ │ 6 Partition Scheme GPT │ │
│ │ 7 Swap Size 2g │ │
│ └────────────────────────────────────────────────┘ │
├────────────────────────────────────────────────────┤
│ <Select> <Cancel> │
└────────────────────────────────────────────────────┘Post install, adding the second encrypted mirror:
Make sure /boot is mounted and view the contents of /boot/loader.conf:
# zpool import bootpool# cat /boot/loader.conf
Code:
geli_ada0p3_keyfile0_load="YES"
geli_ada0p3_keyfile0_type="ada0p3:geli_keyfile0"
geli_ada0p3_keyfile0_name="/boot/encryption.key"
geli_ada1p3_keyfile0_load="YES"
geli_ada1p3_keyfile0_type="ada1p3:geli_keyfile0"
geli_ada1p3_keyfile0_name="/boot/encryption.key"
aesni_load="YES"
geom_eli_load="YES"
vfs.root.mountfrom="zfs:zroot/bootenv/default"
zfs_load="YES"
zpool_cache_load="YES"
zpool_cache_type="/boot/zfs/zpool.cache"
zpool_cache_name="/boot/zfs/zpool.cache"Show partitions and devices:
# gpart show
Code:
=> 34 20971453 ada0 GPT (10G)
34 1024 1 freebsd-boot (512K)
1058 990 - free - (495K)
2048 4194304 2 freebsd-zfs (2.0G)
4196352 12582912 3 freebsd-zfs (6.0G)
16779264 4190208 4 freebsd-swap (2.0G)
20969472 2015 - free - (1.0M)
=> 34 20971453 ada1 GPT (10G)
34 1024 1 freebsd-boot (512K)
1058 990 - free - (495K)
2048 4194304 2 freebsd-zfs (2.0G)
4196352 12582912 3 freebsd-zfs (6.0G)
16779264 4190208 4 freebsd-swap (2.0G)
20969472 2015 - free - (1.0M)# camcontrol devlist
Code:
<VBOX CD-ROM 1.0> at scbus1 target 0 lun 0 (cd0,pass0)
<VBOX HARDDISK 1.0> at scbus2 target 0 lun 0 (ada0,pass1)
<VBOX HARDDISK 1.0> at scbus3 target 0 lun 0 (ada1,pass2)
<VBOX HARDDISK 1.0> at scbus4 target 0 lun 0 (ada2,pass3)
<VBOX HARDDISK 1.0> at scbus5 target 0 lun 0 (ada3,pass4)Create a new GPT partitioning scheme on ada2 and ada3:
# gpart create -s gpt ada2# gpart create -s gpt ada3Create a new single ZFS partition on each device (will take up all the available space on each drive):
# gpart add -t freebsd-zfs ada2# gpart add -t freebsd-zfs ada3Initialize two new GELI providers, reusing the key file created during installation:
# geli init -B /boot/ada2p1.eli -e AES-XTS -K /boot/encryption.key -l 256 -s 4096 /dev/ada2p1
Code:
Enter new passphrase:
Reenter new passphrase:
Metadata backup can be found in /boot/ada2p1.eli and
can be restored with the following command:
# geli restore /boot/ada2p1.eli /dev/ada2p1# geli init -B /boot/ada3p1.eli -e AES-XTS -K /boot/encryption.key -l 256 -s 4096 /dev/ada3p1
Code:
Enter new passphrase:
Reenter new passphrase:
Metadata backup can be found in /boot/ada3p1.eli and
can be restored with the following command:
# geli restore /boot/ada3p1.eli /dev/ada3p1Attach the providers, enter the passphrase for each:
# geli attach -k /boot/encryption.key /dev/ada2p1# geli attach -k /boot/encryption.key /dev/ada3p1Create the new zpool mirror named "tank1":
# zpool create tank1 mirror /dev/ada2p1.eli /dev/ada3p1.eliAdd the following new lines /boot/loader.conf:
Code:
geli_ada2p1_keyfile0_load="YES"
geli_ada2p1_keyfile0_type="ada2p1:geli_keyfile0"
geli_ada2p1_keyfile0_name="/boot/encryption.key"
geli_ada3p1_keyfile0_load="YES"
geli_ada3p1_keyfile0_type="ada3p1:geli_keyfile0"
geli_ada3p1_keyfile0_name="/boot/encryption.key"Export bootpool (unmounting /boot):
# zpool export bootpoolAnd finally, reboot to see if everything is working:
# rebootDuring boot FreeBSD asks for the passphrase four times, as it should, and the new zpool "tank1" is mounted. So everything seems to be working.
Like I said in the beginning, I'm new to both ZFS and GELI. Am I doing this correctly? Is it a mistake to reuse the existing key file?
Thanks,
Mikael