Zpool Decryption does not survives Restart

[troun]

Hi,

After I restarted my NAS (for a few months I guess), I had lots of files corruption and OS was not able to boot. So I simply re-installed properly from CD-rom. Happen the time to import the Zpool; auto-import, decrypt, gely... And all was fine... until I reboot.
Every time I reboot the Zpool is listed but appears as locked and I need to decrypt it manually. When done, shares, SSH or any services are working fine and I can browse/delete/add files on Zpool. Until next restart.

I can add that before the "corrupted restart", pool was healthy, smart test reported nothing particular.


Edit: I tried the folowing;
_ blank installation (no imported config) just import Zpool
_ exporting importing config
_ changing passphrase and new geli key

 

[Dusan]

That is the main point of encryption. If somebody unplugs and steals your server he will not be able to access your data without knowing the passphrase.
If you want the pool to automount then remove the passphrase (change it to empty string).

 

[troun]

So it appears it was a stupid question from me, because I never noticed it was normal behaviour. So thanks for your clarification :) .

Now for my personal understanding;
1. Let say I have automount, NAS is stolen. I do not see how the thief could access data if he does not know any of the SFTP (the only active service that I usually have) accounts or the main admin account. If he use the current system, he will need to log as admin (to add his account or make a samba guest share), and if he reinstall its own freenas he will not be able to import the encrypt zpool. Did I missed something?

2. If I have no passphrase and it happen exactly what happened to me (OS image corruption). During re-import of encrypted zpool, will I not be asked for any passphrase, only for the gely key?

 

[Dusan]

Now for my personal understanding;
1. Let say I have automount, NAS is stolen. I do not see how the thief could access data if he does not know any of the SFTP (the only active service that I usually have) accounts or the main admin account. If he use the current system, he will need to log as admin (to add his account or make a samba guest share), and if he reinstall its own freenas he will not be able to import the encrypt zpool. Did I missed something?

Yes :). There are several ways to get your data. For example, few of them: unplug the USB key and use some other computer to modify the passwd/pw.db files (change/reset passwords) or the FreeNAS config DB (add new shares), return the key and boot. Or, get the geli key from the USB stick and mount the pool on some other FreeBSD machine -- instant access to your data. If the pool does automount that means everything needed to access the data is present. In that case no amount of passwords will help if the attacker has direct access to the HW (e.g. it was stolen).

2. If I have no passphrase and it happen exactly what happened to me (OS image corruption). During re-import of encrypted zpool, will I not be asked for any passphrase, only for the gely key?

Correct.

 

[cyberjock]

Keep in mind you are also assuming that the thieves will have a clue how to use FreeNAS. Now if its a government then you have a problem and that's a bit beyond the scope of your question I'm assuming. But your average local thief... they'll go "WTF" and just try to sell the hardware or find a friend that is "uber" since they know how to install Windows. In either case your data is going to be lost and they aren't going to gain access to it.

If you are trying to hide data from a government entity I doubt you'd go with the automounting. ;) And I wouldn't recommend you use FreeNAS' encryption just in case there's any mistakes with how it is setup and implemented for FreeNAS.

 

[troun]

Yes :). There are several ways to get your data. For example, few of them: unplug the USB key and use some other computer to modify the passwd/pw.db files (change/reset passwords) or the FreeNAS config DB (add new shares), return the key and boot. Or, get the geli key from the USB stick and mount the pool on some other FreeBSD machine -- instant access to your data. If the pool does automount that means everything needed to access the data is present. In that case no amount of passwords will help if the attacker has direct access to the HW (e.g. it was stolen).

I did not imagined that FreeBSD/Freenas left the important data (like you mentionned password, logs, config or evengeli keys) simply stored 'in clear' on the media. I am even quite surprised because, I can be wrong but, I think that even Windows encrypt sensible datas (not talking of whole drive Bitlocker encryption) to reduce such vulnerability.
I think that could be a nice feature added to Freenas if they was an encrypted folder storing all sensible data (account, keys, config...) that would be unlocked on logon. Even if we forget encrypted Zpool, that would be nice that all emails, server addresses, accounts are not easy available.

 

[cyberjock]

Yeah, I'm a bit fuzzy on that. Dusan talked to me about it before. In 8.x nothing was saved on the key. So if you forgot to save your key, you rebooted and lost access to your data forever. In 9.1 that changed. I'm fuzzy on "how" secure the server is though. I'm not all that knowledgeable on how all this stuff works with geli.

If I'm uploading a keyfile and password to unlock my pool and the keyfile is being stored on the USB, they only need my password after stealing my server to decrypt it from what I understand.

And if I'm uploading the recovery key via the GUI... I think that means that my key is being saved to the USB stick, which may mean that I just gave the theoretical thief access to my pool if they know where to get my key from the USB stick.

Kind of sad if this stuff is true though. I'd like to think if a thief stole my server they don't have a key or password unless they steal whatever media has my key and makes me give them the password. :)

 

[Dusan]

I did not imagined that FreeBSD/Freenas left the important data (like you mentionned password, logs, config or evengeli keys) simply stored 'in clear' on the media. I am even quite surprised because, I can be wrong but, I think that even Windows encrypt sensible datas (not talking of whole drive Bitlocker encryption) to reduce such vulnerability.

There's not much you can learn from the USB key. It only contains hashed passowords so, yes, you can change them, but not read them; logs are not stored on the key; geli keys are there by design so that automount works. If you do not want automout use a passphrase
Think about it, it is not possible to have at the same time the automount you desire and the security you want. You could completely encrypt the USB stick, but for the unattended automount you would still need to store that key unencrypted somewhere. If the thing boots unattended and decrypts the pool then anybody who has access to the HW can get the data. You should set a passphrase to prevent that but you will lose the automout.

 

[Dusan]

If I'm uploading a keyfile and password to unlock my pool and the keyfile is being stored on the USB, they only need my password after stealing my server to decrypt it from what I understand.

Yes and that's why you should use a strong passphrase. The new design gives you choice. You can use a passphrase and be safe if somebody stoles the server. Or, do not use passphrase and have automount. This makes sense for somebody who does worry about the server being stolen, but wants to be able to discard failed drives without having to worry that somebody would be able to recover any data (i.e. if the drive electronics fail you are not able to easily run DBAN).

And if I'm uploading the recovery key via the GUI... I think that means that my key is being saved to the USB stick, which may mean that I just gave the theoretical thief access to my pool if they know where to get my key from the USB stick.

No, the recovery key is never stored on the USB stick. It is only briefly stored in /tmp and that is a ramdisk, so any traces of the key dissappear on shutdown.