srch

The zfs create -o encryption command encrypts a newly created ZFS dataset ... Loads the wrapping key to unlock the encrypted dataset and datasets that ...

The locking/unlocking mechanism is but a small part of a (hopefully) vigorous, multi-layer security regimen, and one that is usually considered ...

Data that is needed during system start needs to be decrypted during the boot process. An example of this is an encrypted home directory. The ...

The Arch Linux Wiki has a section on unlocking an encrypted dataset ... If the root filesystem dataset is encrypted, the zfs script in the ...

Native ZFS encryption does not encrypt the ZFS metadata (size, usage, properties, etc), nor does it require unlocking all datasets upon ...

06.12.2020 · The locking/unlocking mechanism is but a small part of a (hopefully) vigorous, multi-layer security regimen, and one that is usually considered an edge case. On a zfs encrypted volume the protection comes if a burglar breaks into your home/office, powers off the NAS and runs away with the disks.

19.11.2021 · ZFS key auto unlock fails 100% in physical theft of the unit. It also prevents you from decrypting and mount a dataset when a specific IP is present. Using ZFS native encryption with a passphrase requires intervention to unlock on boot. For Key encryption, it will automatically unlock on boot without the need for your intervention with a script.

14.10.2021 · We add the possibility to unlock it via ssh. Then we add two types of encrypted ZFS storage: ZFS on top of LUKS and native ZFS encrypted storage …

The CLI makes it incredibly easy to enable encryption on a per dataset/volume basis (zfs create -o encryption=on <dataset>).

OpenZFS native encryption isn't a full-disk encryption scheme—it's enabled or disabled on a per-dataset/per-zvol basis, and it cannot be turned ...

16.02.2020 · Boot-time unlocking of ZFS encrypted datasets Note A disclaimer about the status of this document, as of January 2020: With ZoL version 0.8.1 and newer, systemd mount generators exist that can automatically take a passphase at …

... unlock and mount encrypted datasets. My system is fully encrypted, including boot, root other volumes with lvm on luks (no zfs here).

... to unlock any specific dataset: /etc/systemd/system/zfs-load-key@.service [Unit] Description=Load %I encryption keys ...