Experience with remote unlock of ZFS encrypted pools

OpenZFS
1

Like everyone, I want to automate as much as I can. Including automated spin up of encrypted pools. Sometimes I have a power outage that lasts longer than my battery backups allow. My servers shut down, and then boot back up, after power is restored. I have native encrypted pools that I would also like to come back up automatically. Using TrueNAS, they do come up automatically, but that’s because the keys are loaded locally on the machine, and wouldn’t prevent anything should the whole server be stolen.

So here is my question/topic for discussion. What solutions has people come up with for this type of issue?

Here is a reddit thread I came across while researching the topic: https://www.reddit.com/r/zfs/comments/w33bss/looking_for_best_practice_for_unlocking_encrypted/

In the thread someone mentioned an NFS share from another computer hidden in there home, and the OP, put a USB stick on the other side of a USB keystone jack, inside the wall. Both really neat ideas.

1 Like
2

I’ve set up the dataset with a passphrase it unlocks from the key file. I put the password in a file on a machine I boot up.

This is how I enabled this option:

zfs load-key -l keylocation=file:///mnt/machine/zfs.key -o keyformat=passphrase pool_name

-l loads dataset if not already decrypted.

Note: I wanted to keep the passphrase for various reasons, so I chose the passphrase options, but you can generate a raw output instead

more

Then when you run:

zfs mount pool/dataset

It mounts without requesting a passphrase. For years I have manually typed in the passphrase as this machine is only booted for backups, but this method is more convenient and the key is protected on another machine on an encrypted drive.

1 Like