ZFS Encryption

  • I have recently installed and set up an OMV4 NAS. I would like to set up ZFS with encryption. It seems that LUKS and ZFS do not play well with OMV (something related to the creation of shared folders occurring before the drives are unlocked). It also seems there may not be support yet for running encryption with ZFS in OMV4 (with or without the plugin - not sure on that part).



    Anyways, my question is how to best go about getting a ZFS pool with encryption set up with OMV.
    - LUKS or native encryption (not really sure which is most appropriate or what the advantages or disadvantages are)?
    - Will the plugin support it? I can work from the terminal if needed, but I don’t want to end up with a system where OMV then cannot manage shares, perms, etc.
    - Should I upgrade to Debian Buster or OMV5? Is there a projected/estimated release for OMV5, and would it solve any of my problems?


    Any advice would be much appreicated.


    Edit: I did try just setting up LUKS encrypted drives, but then the ZFS create fails (it says RAIDZ2 requires 3 or more devices - I have 7 - I believe this is a known bug). I might be able to get past this on the CLI, but some googling suggested this will just cause more problems with the shared folder creation at boot.

    • Offizieller Beitrag

    The plugin uses the zfs packages from the Debian repos. None of them are using 0.8.x (version required for native encryption) for Debian 9 or 10. You can install the proxmox kernel on OMV 5.x and it uses the 0.8.1 modules from the proxmox kernel. The plugin doesn't allow creation of a pool with native encryption but you could create it from the command line and import it from the plugin. Then you could use the pool just like it was created from the plugin. I haven't look at how an encrypted zfs pool is unlocked though. And I have no idea when OMV 5.x will be released.

    omv 7.0.5-1 sandworm | 64 bit | 6.8 proxmox kernel

    plugins :: omvextrasorg 7.0 | kvm 7.0.13 | compose 7.1.4 | k8s 7.1.0-3 | cputemp 7.0.1 | mergerfs 7.0.4


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

  • Thanks for the prompt reply. While I did move to the proxmox kernel, I still had some difficulty getting encryption set up. I was able to use ZFS over luks2 with full drive encryption. After I reboot the server, I need to decrypt all the drives an then import the zfs pool, but beyond that I think it’s ok. I haven’t gotten a successful share working yet - but that is in progress, and probably unrelated to zfs (subject for another post).

    • Offizieller Beitrag

    I still had some difficulty getting encryption set up. I was able to use ZFS over luks2 with full drive encryption

    The proxmox kernel only really helps if you are using OMV 5.x. If you are doing that, then you don't need luks (since zfs 0.8.1 installed by proxmox kernel has native encryption) which shouldn't eliminate a lot of your issues.

    omv 7.0.5-1 sandworm | 64 bit | 6.8 proxmox kernel

    plugins :: omvextrasorg 7.0 | kvm 7.0.13 | compose 7.1.4 | k8s 7.1.0-3 | cputemp 7.0.1 | mergerfs 7.0.4


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

Jetzt mitmachen!

Sie haben noch kein Benutzerkonto auf unserer Seite? Registrieren Sie sich kostenlos und nehmen Sie an unserer Community teil!