Re: Encrypting only FreeBSD partition, not entire disk.
Well, true what @wblock said. You should definitely go through those posts. You'll find all the information there you need.
Note before proceeding you should have a backup of your data at hand! Also try this first in virtual machine to get familiar with those commands before doing something you might regret.
This is the way to achieve what you want (
/boot on unencrypted UFS filesystem, encrypted ZFS on /).
Assuming the following layout (this is very close to what you have):
Code:
# gpart show
=> 63 83886017 ada0 MBR (40G)
63 1048572 1 freebsd (512M)
1048635 28318185 2 freebsd (13G)
29366820 54492480 3 ntfs (26G)
83859300 26780 - free - (13M)
Partition #3 is a bootable Windows XP system. Boot FreeBSD LiveCD (I'm using 9.2 RELEASE). Escape to the shell prompt.
0) Remove partition #1 and #2. Check the layout afterwards.
Code:
# gpart delete -i 1 ada0
ada0s1 deleted
# gpart delete -i 2 ada0
ada0s2 deleted
#
# gpart show
=> 63 83886017 ada0 MBR (40G)
63 29366757 - free - (14G)
29366820 54492480 3 ntfs (26G)
83859300 26780 - free - (13M)
#
1) Add new boot partition (#1) and new soon-to-be encrypted vdev for our rpool pool (#2).
Code:
# gpart add -t freebsd -s 512m ada0
ada0s1 added
# gpart add -t freebsd ada0
ada0s2 added
# gpart show
=> 63 83886017 ada0 MBR (40G)
63 1048572 1 freebsd (512M)
1048635 28318185 2 freebsd (13G)
29366820 54492480 3 ntfs (26G)
83859300 26780 - free - (13M)
#
Now a bit of old magic with new gpart. Create BSD label on ada0s1. Add new partition afterwards. (in BSD lingo: create a partition on a slice #1). Format it with UFS.
Code:
# gpart create -s bsd ada0s1
ada0s1 created
# gpart add -t freebsd-ufs ada0s1
ada0s1a added
# gpart show
=> 63 83886017 ada0 MBR (40G)
63 1048572 1 freebsd (512M)
1048635 28318185 2 freebsd (13G)
29366820 54492480 3 ntfs (26G)
83859300 26780 - free - (13M)
=> 0 1048572 ada0s1 BSD (512M)
0 1048572 1 freebsd-ufs (512M)
# newfs -O2 /dev/ada0s1a
/dev/ada0s1a: 512.0MB (1048568 sectors) block size 32768, fragment size 4096
using 4 cylinder groups of 128.00MB, 4096 blks, 16384 inodes.
super-block backups (for fsck_ffs -b #) at:
192, 262336, 524480, 786624
#
# gpart show
=> 63 83886017 ada0 MBR (40G)
63 1048572 1 freebsd (512M)
1048635 28318185 2 freebsd (13G)
29366820 54492480 3 ntfs (26G)
83859300 26780 - free - (13M)
=> 0 1048572 ada0s1 BSD (512M)
0 1048572 1 freebsd-ufs (512M)
=> 0 1048572 ufsid/5305374662b6251a BSD (512M)
0 1048572 1 freebsd-ufs (512M)
#
2) Create encrypted slice for ZFS. Store the metadata in one place, later it'll be copied to root's home. Attach the volume, so we can use it.
Code:
# geli init -b -s 4096 -e AES-CBC -l 128 /dev/ada0s2
Enter new passphrase: <you'll enter your password here>
Reenter new passphrase: <you'll enter your password here>
Metadata backup can be found in /var/backups/ada0s2.eli and
can be restored with the following command:
# geli restore /var/backups/ada0s2.eli /dev/ada0s2
# cp -p /var/backups/ada0s2.eli /tmp
#
# geli attach /dev/ada0s2
Enter passphrase:
#
3) Start the standard ZFS on / procedure. I'll keep it as simple as possible here.
Code:
# zpool create -o cachefile=/tmp/zpool.cache rpool /dev/ada0s2.eli
cannot mount '/rpool': failed to create mountpoint
# zfs set mountpoint=none rpool
# zfs set atime=off rpool
# zfs set checksum=fletcher4 rpool
# zfs create rpool/ROOT
# zfs create -o mountpoint=/mnt rpool/ROOT/default
4) Small deviation from standard ZFS setup. Our unencrypted boot can't be mounted under
/boot directly, we have to do a little workaround here.
Code:
# mkdir /mnt/bootdir
# mount /dev/ada0s1a /mnt/bootdir
5) Let's setup the boot stuff now, so we don't forget. Note that we need to install bootloader per stages.
Code:
# zpool set bootfs=rpool/ROOT/default rpool
# gpart bootcode -b /boot/boot0 ada0
bootcode written to ada0
#
# gpart bootcode -b /boot/boot ada0s1
bootcode written to ada0s1
#
# df -m
Filesystem 1M-blocks Used Avail Capacity Mounted on
/dev/iso9660/FREEBSD_INSTALL 654 654 0 100% /
devfs 0 0 0 100% /dev
/dev/md0 30 0 27 1% /var
/dev/md1 18 0 17 0% /tmp
rpool/ROOT/default 13481 0 13481 0% /mnt
/dev/ada0s1a 495 0 455 0% /mnt/bootdir
6) Install the actual FreeBSD.
Code:
# cd /usr/freebsd-dist
# for i in kernel base lib32; do tar --unlink -xvPjf $i.txz -C /mnt ; done
<--output omitted-->
x ./usr/lib32/pam_permit.so.5
x ./usr/lib32/dtrace/drti.o
x ./usr/bin/ldd32
#
7) Move the
/boot data to our ada0s1a partition. Pay attention to the symlink workaround.
Code:
# cd /mnt/bootdir
# mv /mnt/boot .
# cd /mnt
# ln -s bootdir/boot .
8) Update configuration files. Use editor (
vi) to edit files which are shown with
cat.
Code:
# cp -p /tmp/zpool.cache /mnt/boot/zfs
# cat /mnt/boot/loader.conf
zfs_load="YES"
geom_eli_load="YES"
vfs.root.mountfrom="zfs:rpool/ROOT/default"
#
# cat /mnt/etc/fstab
/dev/ada0s1a /bootdir ufs rw 0 0
#
# cat /mnt/etc/rc.conf
hostname="testbsd"
ifconfig_le0="DHCP" # NOTE!: this is my virtual adapter under vmware
zfs_enable="YES"
sshd_enable="YES"
#
# cp -p /tmp/ada0s2.eli /mnt/root/
#
9) Cleanup and reboot.
Code:
# umount /mnt/bootdir/
# zfs umount -a
# zfs set mountpoint=legacy rpool/ROOT/default
# reboot
After reboot you'll see the menu with an option to which OS to boot (by pressing F1,F2..). There will be one additional option (F2, not usable), I can't remember how to remove it from selection. I think there's a way to do it, some file under
/boot to be edited.
F1 will boot you to the new FreeBSD, F3 to Windows. When booting FreeBSD you'll be prompted for a passphrase to enter in order to activate the ZFS pool.
EDIT: Yeah. A little rtfm payed off
. You can adjust your boot menu with the following command:
For further reading check
boot0cfg(8)
