8

I would like to create a dedicated physical server which will work as a NAS & fileserver inside my LAN (as well as through VPN).

However I need to fully encrypt the drives (both the system ones and the data ones, as I think I'll use two zpools). Since ZFS encryption is not supported in version 28 which is what FreeBSD supports (and OpenIndiana, Nexenta, ...) the only possibility seems to be to use GELI.

Now I'm thinking whethever adding a GELI layer on top of ZFS could lead to data loss. Some posts on the internet (though not many) seems to point this problem out. In particular, ZFS seems to be a far superior filesystem than any other in the Unix/Linux world (for instance ext4, xfs as well as btrfs) considering the integration of RAID(Z) and checksumming.

Now adding GELI on top of that seems to me just like adding LUKS on top of a RAID setup, though I did never experienced Geli and don't know its reliability. Performance is not a main issue, though I'd rather not have a 1MB/s transfer on my LAN (>20MB/s will be acceptable though).

I never got outside my Linux world so I don't have experiences with FreeBSD or the Solaris derivatives. I'd rather not use Solaris Express 11 because of the paid (expensive) support problem. This will be a computer at home. I'll be willing to learn them if necessary.
The server will need to do basics NAS tasks (in particular samba/cifs file sharing, I don't need the ones integrated with the newer ZFS versions).

After considering the encryption layer, will GELI + ZFS be more or less reliable than LUKS + LVM + ext4? I asked in another post on superuser and they suggested FreeBSD/Solaris(es) because of ZFS, though we did not talk about encryption. Don't know if OpenIndiana and the likes support a block encryption method like LUKS or GELI.

Furthermore will it be easy to add a disk to the array, grow the RAID(Z) and the filesystem as we do in Linux (for instance here)?

4 Answers 4

1

You should be able to use one of the geom providers for encryption with ZFS, but you should encrypt the devices below the ZFS. I'd probably setup geli and then make a gpt partition inside of type freebsd-zfs and then go from there.

I recommend you actually test both solutions (freebsd and linux) and decide based on sys admin time and performance which makes sense for you.

2
  • From an admin point of view surely right now for me linux LUKS+LVM+RAID is the way to go. Maybe in the end I'll just do a Virtualbox to try it out as you suggested. I'm a real FreeBSD newbie therefore administration will be pretty difficult for me (at least at first). What I look for is reliability (not performance). It has to be a NAS, though I do not expect exceptional performances such as to saturate a 1Gbps link. Media files will be on another server as well. However I already have a bunch of Linux machines (mostly Debian GNU/Linux 64 bits) which do separate tasks.
    – user51166
    Feb 22, 2012 at 20:55
  • Just wanting some sort of OS "redundancy" in the sense that should ever I have a problem due to updates doing something very bad I'd still have a good portion of my data. Since I'm planning a backup server as well maybe it'll be better to do the NAS with Linux and the Backup server with FreeBSD / Solaris. However be it the NAS or the Backup server I'd like to store data on that machine on a OS different than Linux and using ZFS, but encrypted.
    – user51166
    Feb 22, 2012 at 21:03
1

Solaris 11 supports native encryption within ZFS. If you're not tied to BSD it's something to consider. It's free to use for non-production uses, so you can use it at home without having to purchase a support license.

To grow your pool you will need to add more vdevs, you cannot grow a single raidz or other vdev type by adding more disks to it. However, once you start adding more vdevs ZFS will stripe data across them and you'll gain some additional performance.

3
  • Thank for your answer. I'm not tied to BSD (in fact never used it yet). It's just that should I have a problem with Solaris 11 I would have to buy over 1000$ a year for support. Furthermore I think you're referring to Solaris 11 Express. I'm a student, I don't have that much money.
    – user51166
    Feb 22, 2012 at 20:51
  • 1
    It's not Solaris Express anymore, after 11 came out it's just all Solaris 11 now. I wouldn't worry about the support contract, if you run into trouble with FreeBSD or Linux were are you going to get help? Same thing applies to Solaris.
    – Brennan
    Feb 24, 2012 at 3:47
  • 1
    With Linux and FreeBSD I could get help (here) or in forums. With Solaris 11 I should contact and pay Oracle (or that's what people say on Internet anyway). Or is there something as community (free) support in Solaris ?
    – user51166
    Feb 24, 2012 at 5:22
1

I don't think you need to worry unduly about dataloss. Geli on FreeBSD is mature and in my experience has been bulletproof. Geli first, then ZFS on top. You can then use zpool to build pools in whatever configuration you like - single drive, mirrors, RAID-Z, whatever.

My own experience:

I have a FreeBSD 9 home server with a similar setup - two drives, one zpool on each. It's a ZFS-on-root setup - no UFS. One drive is system, the other is data. The data drive has full-disc encryption, the system drive does not (although I believe there's no reason why it couldn't - I just wanted to avoid the additional complication).

I used geli to encrypt the bare data drive. ZFS (strictly, zpool) sees this just like any other block device and you just call "zpool create ..." in the normal manner, and from there on you create zfs datasets on the pool however you like.

Performance hasn't been an issue in my use-case. Mine is running perfectly fine on a 4GB Atom D520. Probably not lightning fast (the disks are only 5200rpm 2.5", for low power/noise) but fine for home network serving.

This set-up has been running without issue for a couple of years now.

1

If you drop a full disk encryption (FDE) like LUKS or Geli on ZFS, you will not be leveraging as much of ZFS's feature set. However, if you put ZFS on FDE it will work.

I have been hearing discussions from FreeBSD ZFS experts lately where they are recommending PEFS on ZFS as this allows ZFS to still see individual files. It may be possible that PEFS thats configurable to folders and files be configurable and bundled in the FreeBSD ZFS library in the future.

Although there are cryptography experts recommending that we not depend on full disk encryption, I think on FreeBSD or Linux, that a chaining different encryption strategies may be a reasonable strategy.

For instance: Raw Disk -> FDE (Geli/LUKS) -> ZFS -> (for /home) Userland Encryption using PEFS or EncFS. With this model, if the full disk encryption is compromised, and from what I understand its not that difficult if someone has the resources and motivation, you still will have the PEFS/EncFS to protect your most important files which will be much much harder to crack.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .