Encrypting an existing raidz2

So, I decided to give this a try.. and this time in english. This is likely for a broader audience.

Having 8x 2TB drives in a raidz2, I was under the impression that this would force me to migrate the data first before I could  destroy and rebuild the whole pool using encrypted drive ”aliases” instead.

After more research inside a virtual machine with positive results I decided to do it for real.

So I present to you: ”FreeBSD – Encrypting an existing raidz2″.

As the existing raidz2 exists of eight drives, there will be one considerable amount of typing in every reboot of the server (one passphrase for each encrypted drive). As my server is not rebooted that ofted, the benefits outweight this.

First I export my pool, henceforth known as ”tank”. This is to be able to destroy one of the disks without problem.

zpool export tank

The destructive command that make this happen is credited the dd command:

dd if=/dev/zero of=/dev/label/disk0 bs=1M

Note that I use the label alias of the drive. I do like this because I like the label names better, and these are also non-changing, should I have to switch the order of the drives etc.

Before we start encrypting anything we need to have a key that is used when scrambling the data in the encrpytion process. We create this key via this command:

dd if=/dev/urandom of=/boot/encryption.key bs=4096 count=1

This will create a 4096 bytes large file with our goo of ingredients when encrypting our files. We could do really well with 2048 aswell, but what the heck, why not..

Now we get onto the first disk that will receive geli treatment:

geli init -b -B /boot/disk0.eli -e AES-XTS -K /boot/encryption.key -l 256 -s 4096 /dev/label/disk0

Enter your passphrase twice. And please, use a secure passphrase. Not what you have on facebook etc. This should be safe, not NSA-aware

After this is done, we mount it so that we can use the disk through encryption:

geli attach -k /boot/encryption.key label/disk0

And enter the passphrase. Now you will have an alias you should use in the zpool (label/disk0.eli).
Sweet, now let us attach this prepared drive to our pool:

zpool import tank

If we check the pool now, it will report disk0 as unavailable:

zpool status tank

So, we replace the unavailable drive with the new one:

zpool replace tank label/disk0 label/disk0.eli

Let it resilver, or watch it:

zpool status tank

When done, the disk0 will be replaced with the eli-dito.
That was one drive.. seven more to go.
Repeat until done.
Now we just need to adjust the system to load our keyfile and setup geli when booting up.
Edit the /boot/loader.conf file and add these settings into it, or adjust accordingly.

aesni_load="YES"
geom_label_load="YES"
geom_eli_load="YES"

## Disk 0
geli_label_disk0_keyfile0_load=YES”
geli_label_disk0_keyfile0_type=”label/disk0:geli_keyfile0″
geli_label_disk0_keyfile0_name=”/boot/encryption.key”

## Disk 1
geli_label_disk1_keyfile0_load=”YES”
geli_label_disk1_keyfile0_type=”label/disk1:geli_keyfile0″
geli_label_disk1_keyfile0_name=”/boot/encryption.key”

## Disk 2
geli_label_disk2_keyfile0_load=”YES”
geli_label_disk2_keyfile0_type=”label/disk2:geli_keyfile0″
geli_label_disk2_keyfile0_name=”/boot/encryption.key”

## Disk 3
geli_label_disk3_keyfile0_load=”YES”
geli_label_disk3_keyfile0_type=”label/disk3:geli_keyfile0″
geli_label_disk3_keyfile0_name=”/boot/encryption.key”

## Disk 4
geli_label_disk4_keyfile0_load=”YES”
geli_label_disk4_keyfile0_type=”label/disk4:geli_keyfile0″
geli_label_disk4_keyfile0_name=”/boot/encryption.key”

## Disk 5
geli_label_disk5_keyfile0_load=”YES”
geli_label_disk5_keyfile0_type=”label/disk5:geli_keyfile0″
geli_label_disk5_keyfile0_name=”/boot/encryption.key”

## Disk 6
geli_label_disk6_keyfile0_load=”YES”
geli_label_disk6_keyfile0_type=”label/disk6:geli_keyfile0″
geli_label_disk6_keyfile0_name=”/boot/encryption.key”

## Disk 7
geli_label_disk7_keyfile0_load=”YES”
geli_label_disk7_keyfile0_type=”label/disk7:geli_keyfile0″
geli_label_disk7_keyfile0_name=”/boot/encryption.key”

Reboot and type the passphrase.. and again.. and again… etc.

Enjoy encrypted zpool under FreeBSD!

When you have the need to quickly ”pull the plug”, export the pool, and detach your encrypted drives (script candidate!):

zpool export tank
geli detach label/disk{0..7}.eli

These can be put into a one-liner:

zpool export tank && geli detach label/disk{0..7}.eli

The {0..7} is a shorthand command to include all drives, 0 through 7.
Just for convenience.

There you have it. Hope you enjoyed the guide!
Feel free to comment or ask me to add additional information.