Live data from Hacker News

Playing with ZFS encryption on Linux

rolando.cl

21–30 of 56 posts

Re: Playing with ZFS encryption on Linux

#21

Does anyone know a good guide for getting set up with ZFS (particularly on Linux/Ubuntu)? The Ubuntu wiki basically just say "apt install zfs" and then links to a page that appears to be a brain dump of all the possible commands. Something with more coherence explanation of the relevant concepts would be really helpful.

What are you setting up ZFS for?

Re: Playing with ZFS encryption on Linux

#22

Does anyone know a good guide for getting set up with ZFS (particularly on Linux/Ubuntu)? The Ubuntu wiki basically just say "apt install zfs" and then links to a page that appears to be a brain dump of all the possible commands. Something with more coherence explanation of the relevant concepts would be really helpful.

I have documented the steps I had to take here https://janweitz.de/article/creating-a-zfs-zroot-raid-10-on-...

Be aware:

Uefi did not work for me in VirtualBox with ZFS.

Booting with UEFI, ZFS and RAIDz works, but I did not figure out how to install the UEFI grub-boot on all RAIDz drives.

Therefore, if the one and only drive with the boot partition fails, I have to rely on an USB-stick as a backup-plan for the bootloader.

Probably if I could start over I would try to skip UEFI and use legacy booting and installing Grub in the MBR of each drive (if that is possible).

For encryption we are using Luks right now, since it encrypts block devices and ZFS uses these block devices to form its raid.

Luks needs to decrypt ALL raid devices inside the Grub boot prompt in order for ZFS to start its raidz.

To make this happen, we had to modify:

/usr/share/initramfs-tools/hooks/cryptroot and remove an early return in a for-loop in get_fs_devices() , since otherwise only the first device was decrypted.

Make sure /etc/lvm/lvm.conf contains use_lvmetad = 0

Make sure /etc/default/grub contains GRUB_ENABLE_CRYPTODISK=y GRUB_CMDLINE_LINUX_DEFAULT=“text"

So, yeah, I am looking forward for zfs-native encryption on Linux to make booting "safer/easier".

Re: Playing with ZFS encryption on Linux

#23

Earlier quoted context omitted.

Solaris is completely separate, but I believe the encryption comes from Illumos just needs a ton of changing to work on Linux.

Just the crypto primitives are from Illinois iirc, the actual scheme is fairly new.

Didn't Oracle ZFS have encryption for some time now? (Was that after closing Solaris?)

Re: Playing with ZFS encryption on Linux

#24
I've been really looking forward to OpenZFS encryption support. ZFS on LUKS leaves a lot to be desired, and I've only just recently begun trying to shift all my PCs and devices to be fully encrypted by default.

Re: Playing with ZFS encryption on Linux

#25
Will this work the same way on FreeBSD/FreeNAS when this eventually lands?

OT: one of the sed lines is hard to read

   sed -i 's/github.com\/zfsonlinux\/zfs.git/github.com\/tcaputi\/zfs.git/' PKGBUILD

the OP might leverage that you can use other quoting characters, like

   sed -i 's,github.com/zfsonlinux/zfs.git,github.com/tcaputi/zfs.git,' PKGBUILD

Re: Playing with ZFS encryption on Linux

#26

A little more details on the crypto aspects: https://blog.heckel.xyz/2017/01/08/zfs-encryption-openzfs-zf... (This is my post. I hope it's okay to post this here.)

Have the design decisions been reviewed by a cryptographer yet? According to the presentation on youtube, it had not.

Re: Playing with ZFS encryption on Linux

#27
post #23

Earlier quoted context omitted.

Just the crypto primitives are from Illinois iirc, the actual scheme is fairly new.

Didn't Oracle ZFS have encryption for some time now? (Was that after closing Solaris?)

yeah it was done after closing

this is an independent implementation for the open source side

Re: Playing with ZFS encryption on Linux

#28

Does anyone know a good guide for getting set up with ZFS (particularly on Linux/Ubuntu)? The Ubuntu wiki basically just say "apt install zfs" and then links to a page that appears to be a brain dump of all the possible commands. Something with more coherence explanation of the relevant concepts would be really helpful.

Just another tip, which will give you an easier ZFS setup on Debian.

Use https://www.proxmox.com/. They use Debian and it just works with ZFS.

Re: Playing with ZFS encryption on Linux

#29

Will this work the same way on FreeBSD/FreeNAS when this eventually lands? OT: one of the sed lines is hard to read sed -i 's/github.com\/zfsonlinux\/zfs.git/github.com\/tcaputi\/zfs.git/' PKGBUILD the OP might leverage that you can use other quoting characters, like sed -i 's,github.com/zfsonlinux/zfs.git,github.com/tcaputi/zfs.git,' PKGBUILD

FreeNAS has supported zfs encryption for a long while, unless I misunderstand you. Unless its not actually zfs encryption but something else?

Re: Playing with ZFS encryption on Linux

#30
Can I zfs send encrypted incremental snapshots to a remote server and have them merged without ever having the remote server decrypt anything? That would be awesome to backup to an untrusted remote computer.
Post reply on HN