Full UFS encryption process alike ZFS

[patrivoglio]

Hello,

I am checking out FreeBSD and its documentation as I am preparing to make a switch to it on my daily laptop and a few home devices. I made two test installations, one with ZFS and one with UFS and I noticed that the boot and decryption process looks a bit differently between those two filesystem options.

What I like about the ZFS guided partitioning with encryption enabled is that on surface it works comparatively to the way I have setup my OpenBSD box - it asks me for a passphrase immediately before seemingly loading anything. Under the UFS setup that I followed looking over at some videos on YouTube [1] [2] as well as some websites with similar walkthroughs, the process is slightly different - it first show Beastie and starts echoing some loading messages, only to ask me for a passphrase after a while, which also happens to be a bit untidy as it also prints a number of messages *after* already having asked for the passphrase and then hangs with just a underscore prompt waiting for password.

I suppose my question is if anyone managed to set up the UFS disk encryption the way it is for a ZFS setup - with the decryption happening early and not after Beastie? Is that possible? I was thinking of taking a look at installer scripts to perhaps see what is being done for ZFS and then trying to tune it to work with UFS, but I figured I'd ask first here before I start messing with a live device.

[1]

View: https://www.youtube.com/watch?v=FmRgCXlhHds

[2]

View: https://www.youtube.com/watch?v=lfIXnmI_2UA

 

[chrbr]

Hello patrivoglio,
may be https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/disks-encrypting.html gives enough information. I guess that this is what you want (from the geli section):

Allows the root partition to be encrypted. 
The passphrase used to access the encrypted root 
partition will be requested during system boot.

 

[patrivoglio]

Thank you. I looked over it, but I'm still unable to install the OS correctly. The installer either encounters a problem once I exit shell partitioning and needs to restart or, if it manages to finish the installation and configuration, no system is detected after reboot.

The steps I have been following

# Partitioning
gpart create -s gpt ada0
gpart add -t efi -s 256M ada0              # ada0p1
gpart add -t freebsd-boot -s 1024M ada0    # ada0p2
# some space left
gpart add -t freebsd ada0                  # ada0p3
# some space left
newfs -tU ada0p2

# Encryption
geli init -s 4096 -l 256 -b /dev/ada0s3
geli attach /dev/ada0s3

# Partitioning of the attached encrypted provider
gpart add -t freebsd-swap -s 4G /dev/ada0s3.eli   # .elia == swap
gpart add -t freebsd-ufs -s 60G /dev/ada0s3.eli   # .elib == root
gpart add -t freebsd-ufs -s 10G /dev/ada0s3.eli   # .elid == var
gpart add -t freebsd-ufs /dev/ada0s3.eli          # .elie == home

newfs -tU /dev/ada0s3.elib    # root filesystem
newfs -tU /dev/ada0s3.elid    # var filesystem
newfs -tU /dev/ada0s3.elie    # home filesystem

I tried also mounting those partitions before exiting the shell partitioning;

mkdir -p /mnt/var /mnt/home
mount /dev/ada0s3.elib /mnt
mount /dev/ada0s3.elid /mnt/var
mount /dev/ada0s3.elie /mnt/home

I suppose it may very well be me not really knowing what I'm doing, but then, this UFS encryption process is not excessively straightforward either.
I've been also trying to copy some of the boot code to the efi partition, mount /dev/adap2 (freebsd-boot) to /mnt/boot but those haven't changed the end result.

 

[chrbr]

geli init -s 4096 -l 256 -b /dev/ada0s3

There is no key file specified. I am not sure if this is ok or not because I have not used encryption of root. But geli(8) has an example in the EXAMPLES section about how to configure two providers which will be attached on boot, before the root filesystem is mounted. This is quite detailed. Therefore I do not copy it to the forum post. I am sure that it is of help.