YAET - Yet another encryption thread - GELI Details

[webdawg]

Is this still true?:
https://forums.lawrencesystems.com/t/freenas-automatic-decryption-on-boot/2586

The fact that you can auto unlock, and choose to manually unlock via web interface using GELI?

IIRC when I was looking into this years ago, if you chose to automatically unlock, it would store the encryption keys on whatever/wherever you chose for logging/system partition. Usually with most USB boot types, it would be somewhere on the first dataset?

Is this still true?

Has this encryption scheme been audited?

When you unlock via web GUI, is the key stored anywhere else but memory? Is it stored in tmpfs? Is it just stored in memory via FreeBSD software (GELI) etc?

When you encrypt in FreeNAS does the keysize default to 256 or can you choose?

Thanks!

 

[webdawg]

I am really interested in getting some answers on this, and I suppose I will dive into it myself.

 

[webdawg]

No one has any comment on this at all?

 

[webdawg]

Any help on this?

 

[Samuel Tai]

See this FreeBSD talk on GELI encryption. As I understand it, the keys are stored in /data/geli. One is a master key to unlock the GEOM device and provide access to the decrypted sectors. The user key to unlock the master key is also in /data/geli, and this has a choice of being configured with or without a passphrase. If set without a passphrase, the user key will automatically unlock the master key on boot. If set with a passphrase, then the administrator will need to enter the passphrase after boot to unlock the master key to unlock the data pool.

Note, since 11.3, any GELI-encrypted zpool containing the system dataset no longer supports passphrases.

 

[webdawg]

thanks!