0

I'm in the process of setting up a FreeBSD 10 server on a KVM vserver.

I'm really new to FreeBSD in general (coming from Debian Linux).

I installed the system choosing ZFS with encrypted root volume and encrypted swap.

I chose this solution to protect my files (Emails, Filesharing, etc.) from outside access.

I then realized that I have to enter the passphrase on every bootup and the files (of course) are decrypted afterwards and available to everyone with access.

Is there a sane solution that I'm missing that would make it possible to encrypt only certain parts of the base system (to be able to boot without VNC and enter the passphrase via SSH)?

Is the whole idea of encrypting on a server stupid (since the volumes need to be decrypted for the services to work)?

Would encrypted jails be a solution or just increasing complexity?

0

Is there a sane solution that I'm missing that would make it possible to encrypt only certain parts of the base system (to be able to boot without VNC and enter the passphrase via SSH)?

There are lots of ways to encrypt files. PEFS might be what you want.

Is the whole idea of encrypting on a server stupid (since the volumes need to be decrypted for the services to work)?

No, not really, the data is still encrypted at rest, which can be important, and it also means that it's harder for someone with access to the host (KVM server) to gain access to the guest (FreeBSD) data.

Would encrypted jails be a solution or just increasing complexity?

You're still going to need to enter the key for them at boot, you're just going to be able to do it via SSH instead of VNC, but I imagine you'd have different keys for each jail so multiple pass-phrases to enter.

Personally, I'd stick with the encrypted disk. Rebooting shouldn't be so common that entering the pass-phrase at boot is a major issue, IMHO.

  • I decided to stick with full disk encryption – basbebe Mar 13 '15 at 10:29
0

In ZFS, encryption is at the file system level - not at the level of zpools - so instead of encrypting the whole rpool, you could pick and choose which filesystems to encrypt individually.

As an example,

# zpool create halfcrypt mirror file1 file2

# zfs create -o mountpoint=/public halfcrypt/public
# zfs create -o encryption=on -o mountpoint=/whatever halfcrypt/protected

The volume can't be decrypted, but if you start over, you can install an unencrypted root pool, then selectively enable encryption

# zfs set -r encryption=on rpool/export/home
# zfs set -r encryption=on rpool/swap
  • 1
    AFAIK, *BSD does not yet support native ZFS encryption. This feature was implemented for Solaris but is not open source. – Slizzered Apr 9 '15 at 17:26
  • Ah -- I was testing on Solaris in fact, should've noted that – adamtamu Apr 9 '15 at 21:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.