How to restore encryption key when creating new boot disk?

[EvanVanVan]

I asked this in another thread but it was missed. Reading the FreeNAS FAQ, it says don't worry about cloning the boot disk, just create a new one and upload a copy of your config file. OK, but I don't see the option to upload my encryption key? The 5 buttons under the Storage > Volumes section don't seem to be related, only about changing/updating the key or passphrase

p.s. I did think about removing the encryption but I saw the only way of doing it seemed to be rewriting each drive individually without encryption (or something). I didn't really finish reading it, it seemed dangerous/a lot of work.

Thanks

 

[joeschmuck]

This topic is covered several times in these forums. Do a google search for "freenas encryption key save" or something similar. I haven't read much about removing encryption, I thought you had to backup your data, destroy your pool and recreate it without encryption but maybe something changed.

 

[EvanVanVan]

I always search first. But FreeNAS encryption key save seems to be backing up the key file. I've downloaded it and saved it, i'm wondering how to get it back on the drive? Which from what I've found, is not covered. I even searched Freenas encryption restore key.

And as I mentioned in my first post, I searched, found the instructions (http://forums.freenas.org/index.php...om-a-zfs-volume-while-keeping-the-data.16467/) and gave up on the idea of removing encryption.

Edit: I looked harder after searching and I supposedly found instructions in the last few posts in this thread: http://forums.freenas.org/index.php?threads/how-to-have-a-backup-boot-usb-with-encryption.20857/

Thanks

 

[Knowltey]

If you have an encrypted pool the Geli.key **should** be included in the config backup. But you should be better safe than sorry and also download the geli.key on its own and store it in a safe place not on the encrypted pool.

How to get it back in is as simple as putting the geli.key file in the appropriate field when you are doing the pool auto-import.

 

[cyberjock]

You guys are confused as all hell.

The config file has no geli key. And it shouldn't include a geli key. If it did anyone with your config file would have access to your pool.

The config file only has one thing in it relating to the pool, the name of the pool and the disks in the pool.

The disks in the pool have their part of the encryption/decryption process and the key you download from the WebGUI is the other 1/2 of that encryption/decryption process.

So no, the config doesn't have your key, never has had your key, and shouldn't have your key.

 

[Knowltey]

You guys are confused as all hell.

The config file has no geli key. And it shouldn't include a geli key. If it did anyone with your config file would have access to your pool.

The config file only has one thing in it relating to the pool, the name of the pool and the disks in the pool.

The disks in the pool have their part of the encryption/decryption process and the key you download from the WebGUI is the other 1/2 of that encryption/decryption process.

So no, the config doesn't have your key, never has had your key, and shouldn't have your key.

Mine did earlier tonight. I did a fresh reinstall on my USB. booted, restored config, and then all I had to do was put in my passphrase to unlock my pool which means that the geli.key file was already in the config.

recent change perhaps?

EDIT: I be the village idiot.

 

[joeschmuck]

Mine did earlier tonight. I did a fresh reinstall on my USB. booted, restored config, and then all I had to do was put in my passphrase to unlock my pool which means that the geli.key file was already in the config.

recent change perhaps?

Can't wait to hear the response to that one. Was that with 9.2.1.7?

 

[Knowltey]

Can't wait to hear the response to that one. Was that with 9.2.1.7?

Yeah, but the config file was saved out of 9.2.1.6.

EDIT: I'm an idiot, just got home and checked, apparently didn't actually start the stick reimage, so basically all I did was just reupload the config to the old stick, so that would make sense as to why the geli key would still be there.