1

Preface: I used to run TrueNAS (SCALE) which is where I originally created the tank pool.

On Ubuntu Server, I'm trying to assign/change the key of a newly created pool but I am getting the error Key change error: Dataset not encrypted.:

user@homeserver:~$ sudo zfs change-key -o keylocation=file:///path/to/zpool.key -o keyformat=raw flash
Key change error: Dataset not encrypted.

user@homeserver:~$ zfs get encryption tank 
NAME  PROPERTY    VALUE        SOURCE
tank  encryption  aes-256-gcm  -

user@homeserver:~$ zfs get encryption flash
NAME   PROPERTY    VALUE        SOURCE
flash  encryption  off          default

This is the command I used when I created the pool:

sudo zpool create -o failmode=continue -o autoexpand=on -o autotrim=on -o feature@async_destroy=enabled -o feature@empty_bpobj=enabled -o feature@lz4_compress=enabled -o feature@multi_vdev_crash_dump=enabled -o feature@spacemap_histogram=enabled -o feature@enabled_txg=enabled -o feature@hole_birth=enabled -o feature@extensible_dataset=enabled -o feature@embedded_data=enabled -o feature@bookmarks=enabled -o feature@filesystem_limits=enabled -o feature@large_blocks=enabled -o feature@large_dnode=enabled -o feature@sha512=enabled -o feature@skein=enabled -o feature@edonr=enabled -o feature@userobj_accounting=enabled -o feature@encryption=enabled -o feature@project_quota=enabled -o feature@device_removal=enabled -o feature@obsolete_counts=enabled -o feature@zpool_checkpoint=enabled -o feature@spacemap_v2=enabled -o feature@allocation_classes=enabled -o feature@resilver_defer=enabled -o feature@bookmark_v2=enabled -o feature@redaction_bookmarks=enabled -o feature@redacted_datasets=enabled -o feature@bookmark_written=enabled -o feature@log_spacemap=enabled -o feature@livelist=enabled -o feature@device_rebuild=enabled -o feature@zstd_compress=enabled -o feature@draid=enabled flash mirror /dev/disk/by-partuuid/XXX /dev/disk/by-partuuid/XXX

What am I doing wrong and how can I encrypt flash the same way tank is encrypted?

0

1 Answer 1

2

Native ZFS encryption does not encrypt pools, it only encrypts filesystems. Further, per-filesystem encryption has to be set up at the time the filesystem is created. In the case of the pool's root filesystem, this means that encryption of the root filesystem must be set at the time the pool is created.

So to create a new pool with an encrypted root filesystem in a similar fashion to that of your existing pool, begin by destroying the new pool:

# zpool destroy flash

Then re-create the pool, merging your zpool create command above with these additional options. Note the use of capital -O:

# zpool create \
    (your options from above) \
    -O encryption=on \
    -O keyformat=(whatever) \
    -O keylocation=(whatever) \
    flash \
    mirror /dev/gpt/diskA-serial-num /dev/gpt/diskB-serial-num

Finally, verify:

# zfs get encryption,keyformat,keylocation flash
NAME   PROPERTY     VALUE        SOURCE
flash  encryption   aes-256-gcm  -
flash  keyformat    (whatever)   -
flash  keylocation  (whatever)   local
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .