LUKS/dm-crypt

Features
1

Are there any plans to work drive encryption into RockStor? I know it’s not supported natively by BTRFS, but creating a filesystem on encrypted partitions seems to be pretty safe nowadays (EX: http://nyeggen.com/blog/2014/04/05/full-disk-encryption-with-btrfs-and-multiple-drives-in-ubuntu/).


I’m mostly interested in this feature to make it easy to send failed hard drives in for warranty replacement without worrying that all my data is going along with them as cleartext.

2

This is something we discussed among the team, but fell short of a plan mainly because nobody has asked for it. until now :slight_smile: I tend to agree that this is a very useful feature.

I’d definitely like to test it out. Thanks for the link.

Have you tried to encrypt disks of a pool manually in Rockstor?

3

Just so we don’t forget this request, I’ve created an issue:

https://github.com/rockstor/rockstor-core/issues/550

Feel free to participate on github also. Thanks!

4

Thanks, Suman. Sorry for the delayed reply. For some reason, I don’t seem to be able to post to these forums from either my phone or my tablet. When I get to the posting window, keystrokes from the virtual keyboard don’t show up in the edit window.


I just assembled the NAS hardware over the past few days. After more research, it looks like I’m going to be using this new system as more than just a NAS, so I’ll likely install a generic distro rather than a NAS specific one. I will be using disk encryption, so I’ll be happy to post back with how well that plays with BTRFS.
5

Sorry for the delay. Below is a quick list of what I had to do under OpenSUSE 13.2 to create and mount a 2 drive RAID 1 BTRFS pool. All operations performed as root:


Workaround as per this thread:

# cp /usr/lib/udev/rules.d/64-btrfs.rules /etc/udev/rules.d/64-btrfs.rules

edit /etc/udev/rules.d/64-btrfs.rules and replace

ENV{DM_NAME}=="", IMPORT{builtin}=“btrfs ready $devnode"
ENV{DM_NAME}==”?*", IMPORT{builtin}="btrfs ready /dev/mapper/$env{DM_NAME}"

with

IMPORT{builtin}="btrfs ready $devnode"

Create 1 partition on /def/sda and /dev/sdb using Partioner

Create LUKS volumes on the new partitions using both a key file and password as per https://www.peterbeard.co/post/i-am-a-data-hoarder-or-how-to-create-a-btrfs-raid-on-multiple-encrypted-disks/

# dd if=/dev/random of=~/btrfs.key bs=1 count=256
# cryptsetup --key-file=data.key luksFormat /dev/sda1
# cryptsetup --key-file=data.key luksFormat /dev/sdb1
# cryptsetup --key-file=data.key luksAddKey /dev/sda1
# cryptsetup --key-file=data.key luksAddKey /dev/sdb1
# cryptsetup luksUUID /dev/sda1
Record UIID for later use
# cryptsetup luksUUID /dev/sdb1
Record UUID for later use

# Encrypted partitions
data1 UUID=<UUID of /dev/sda1> /root/data.key luks
data1 UUID=<UUID of /dev/sda1> /root/data.key luks

restart

sudo su -
# mkfs.btrfs -m raid1 -d raid1 /dev/mapper/data1 /dev/mapper/data2

# lsblk -f
Record UUID of btrfs on data1 and data2

# mkdir /data

Add the following to /etc/fstab using variation of instructions found at https://www.peterbeard.co/post/i-am-a-data-hoarder-or-how-to-create-a-btrfs-raid-on-multiple-encrypted-disks/
UUID=<UUID of btrfs from data1/data2> /data auto defaults 0 0

reboot

6

I’m sure all of this is non-optimal, but it does appear to have resulted in a btrfs pool on two LUKS volumes. The workaround at the top prevents the system from dropping into the emergency console at boot. Not sure it applies to other distros.


7

Thanks for sharing useful information.

8

This post still comes up at the top of the google search for Rockstor encryption support. I just wanted to bump it in the hope that it renews interest and support.

9

Bump.

Any traffic on this? Even if EXT was required for the share, it’d be worth having this feature. This is a huge feature required for any business user and any advanced home user.

I’ve been maintaining my own Samba on LUKS ext4 and Rockstor makes it almost illogical for me to maintain my own NAS setup. Frankly, I LOVE Rockstor. Encryption (even if it required EXT4 for that disk) would knock it over the top for me. Thanks!!

10

@gokev Welcome to the Rockstor community. There have been a number of fairly recent improvements ‘under the hood’ as it where in Rockstor that are intended to help pave the way for this feature so yes some ‘traffic’ and it is recognised as a key feature and as such is fairly high on the list as I understand it. But there are one or two more issues that have to be addressed first to ensure that we don’t break more than we add / fix when we finally get around to sorting this one. Linking to the open issue on LUKS support where all development directly related to this will be logged.

I have also linked back to this thread from within the issue, which was opened by @suman as a result of this thread.

The 2 most recent moves towards helping with the support of full disk encryption by way of laying better foundations is the move to by-id names internally and the addition and then enhancement of a Disk.role field (over a number of pull requests); an internal flag mechanism to aid in more robustly supporting more advanced disk roles.

So we do have development in this direction.

There are also plans within btrfs itself to add encryption so as and when they materialise I expect they will be included as appropriate options within Rockstor and may well be much easier to add as it goes but don’t as yet exist.

Hope that answers your question and glad you like what we are all helping to make so far.

11

I just got Rockstor up and running. This is personally one of the highest on my list of wants from Rockstor. I hope some work goes into getting encrypted shares.

Thanks Rockstor team!

1 Like