0

I'm in the process of setting up a FreeBSD 10 server on a KVM vserver.

I'm really new to FreeBSD in general (coming from Debian Linux).

I installed the system choosing ZFS with encrypted root volume and encrypted swap.

I chose this solution to protect my files (Emails, Filesharing, etc.) from outside access.

I then realized that I have to enter the passphrase on every bootup and the files (of course) are decrypted afterwards and available to everyone with access.

Is there a sane solution that I'm missing that would make it possible to encrypt only certain parts of the base system (to be able to boot without VNC and enter the passphrase via SSH)?

Is the whole idea of encrypting on a server stupid (since the volumes need to be decrypted for the services to work)?

Would encrypted jails be a solution or just increasing complexity?

2 Answers 2

0

Is there a sane solution that I'm missing that would make it possible to encrypt only certain parts of the base system (to be able to boot without VNC and enter the passphrase via SSH)?

There are lots of ways to encrypt files. PEFS might be what you want.

Is the whole idea of encrypting on a server stupid (since the volumes need to be decrypted for the services to work)?

No, not really, the data is still encrypted at rest, which can be important, and it also means that it's harder for someone with access to the host (KVM server) to gain access to the guest (FreeBSD) data.

Would encrypted jails be a solution or just increasing complexity?

You're still going to need to enter the key for them at boot, you're just going to be able to do it via SSH instead of VNC, but I imagine you'd have different keys for each jail so multiple pass-phrases to enter.

Personally, I'd stick with the encrypted disk. Rebooting shouldn't be so common that entering the pass-phrase at boot is a major issue, IMHO.

1
  • I decided to stick with full disk encryption
    – basbebe
    Commented Mar 13, 2015 at 10:29
0

In ZFS, encryption is at the file system level - not at the level of zpools - so instead of encrypting the whole rpool, you could pick and choose which filesystems to encrypt individually.

As an example,

# zpool create halfcrypt mirror file1 file2

# zfs create -o mountpoint=/public halfcrypt/public
# zfs create -o encryption=on -o mountpoint=/whatever halfcrypt/protected

The volume can't be decrypted, but if you start over, you can install an unencrypted root pool, then selectively enable encryption

# zfs set -r encryption=on rpool/export/home
# zfs set -r encryption=on rpool/swap
2
  • 1
    AFAIK, *BSD does not yet support native ZFS encryption. This feature was implemented for Solaris but is not open source.
    – Slizzered
    Commented Apr 9, 2015 at 17:26
  • Ah -- I was testing on Solaris in fact, should've noted that
    – adamtamu
    Commented Apr 9, 2015 at 21:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .