1

Before my question, a little background info, as I'm not sure whether it might be pertinent or not:

I am trying to set up full disk encryption using GELI, booting from an external thumb drive, on FreeBSD 10.1. I've done this several times over the years with earlier versions of FreeBSD, based on section 3.5 of the this paper.
It's pretty out of date by this point - written in 2005 based on FreeBSD 6.0 - but it's served me well over the years and I haven't yet been able to find anything more recent.
Anyway, I have wiped the hard drive, and done geli init, geli attach, bsdlabel, and newfs. Now I'm trying to install the system, as in the bottom part of section 3.5.4, which starts:

mount /dev/ad0.elia /fixed

When I try to do this, it tells me "No such file or directory" (referring to /fixed).
So, I try mkdir /fixed. But it then tells me "Read-only file system".
Then I did a chmod +w /, which didn't complain to me, and tried the mkdir again, but it again told me that it was a read-only file system.

How can I do this? Thanks.

Edit: Poking around, I found that there's a preexisting /mnt directory, and I can mount into that. I can't mkdir /mnt/fixed, though, so I guess I can only mount one thing at a time. And there's no /dist directory, I can't find anything like /dist/10.1-RELEASE, and there seems to be no file anywhere called install.sh, so I can't do what I wanted to do by mounting anyway... but I guess that's a different question.

  • how about chmod -R +w / ? – schaiba Dec 7 '14 at 17:34
  • Thanks, but chmod -R +w / itself caused a billion "read-only file system" messages (on various subdirectories), and then following it up with the mkdir still caused one also. – Bob Vesterman Dec 7 '14 at 17:43
  • At this point, I don't quite know what your question is. You've been able to mount the drive, does that solve everything or is there something else? – SailorCire Dec 7 '14 at 18:39
  • I edited my post to indicate that I have figured out how to mount the drive. Unfortunately, no, it does not solve everything, but I think the newly discovered issues are more appropriate for another question, not this one. – Bob Vesterman Dec 7 '14 at 18:41
1

The installer now has support for setting up ZFS on top of geli. I highly recommend you use the installer. It does things a bit differently than it sounds like you're trying to (didn't follow the link), but it works well.

The new installer setup creates two GPT partitions, one for /boot where only the kernel and a password protected copy of the encryption key. At boot, the kernel prompts for the password and sets up the encrypted disk. So the only thing unencrypted is your kernel.

And you can easily and safely copy the password protected key to your external thumb drive, or even better, setup an external disk to replicate the unencrypted boot and encrypted root and zfs send to an external disk for a full system backup, which you can then take off-site.

  • Thanks. I did actually try the new standard ZFS encryption after finding out about it, but got very frequent kernel panics (like, immediately after boot or a few minutes after boot, every time). Eventually I wound up going back to trying to figure out how to do it with UFS, and was able to do so. In case anyone else is interested, I put the steps I took up on the web: vesterman.com/FreeBSD/FullDiskEncryption – Bob Vesterman Jan 27 '15 at 21:36
  • Glad you got it working, but it's odd that you got panics with the standard ZFS encryption. It would be helpful if we could try to troubleshoot that so others don't encounter the same issue. – Steve Wills Jan 29 '15 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.