Send unencrypted snapshot, receive it in encrypted dataset without keys loaded?

OpenZFS
1

Hi,

I wonder if it’s possible to send snapshot of unencrypted dataset to encrypted dataset (destination) without providing a key of encrypted dataset (destination)?
Basically idea would be to make secure backup that is always “locked” (no keys provided) and will be only “unlocked” with keys when there is a need for restore from this backup.

Thanks

1 Like
2

Yep, it’ll automatically inherit the properties of its parent dataset. So as long as your target is the child of an encrypted dataset, it will be encrypted on arrival with the same key.

1 Like
3

I think OP meant if the keys are not loaded at the receiving end.

4

If that’s the case, then the answer is essentially “no.” The only way to encrypt a dataset with a key not available on the host is by first encrypting it elsewhere (where the key IS available), then doing a raw send (–sendoptions=w) to the host which doesn’t have the key.