hi, i sort of cross-post from the smartos matrix room:

i'm wondering whether encrypting a remote standalone smartos server is feasible, given that i can't have kvm access.

i'm thinking about enabling encryption at zones' pool creation, pointing at a keyfile (so keyformat=raw) hosted on a small unencrypted partition that would contain garbage most of the time (during normal runtime) and that i would rewrite with correct material just before planned reboots.

does the loader support booting in such a scheme ? have anybody done something similar, or with the same intent found a practical solution ?

fgudin: no.. loader does not currently know how to read encrypted zfs datasets

the lack of KVM access does make things rather challenging... it might be good to understand the threat model you're trying to deal with..

e.g. what is there for triton is concerned around someone walkign away with the disks from a server (or an individual compute note itself)

I have code to read with passphrase, adding keyfile there is not a big deal. securing keyfile (or password prompt) is quite a different matter though.

jbk: the threat model is basic: this is a personal server where i'll put my (and my family's) data

i want the drives to be ciphered in case some hw replacement has to be done

tsoome_: is this code you hook in somehow, or patch against sthg ? i'd be interested to see

I need to see if I have collected it to separate branch...

checking with nightly + basic test;)

nice, thank you :)

What already works is creating an encrypted fs in the global zone and passing it into a zone via lofs. After booting you'll have to ssh into the system, shutdown the zone, zfs load-key+zfs mount and restart the zone. It's not the best but if you only care about some data (not the whole system) and don't mind the manual work on reboot its fine

i thought encryption was a pool-level property: wouldn't it require a distinct pool ?

nope, you can do something like "zfs create -o encryption=aes-256-gcm -o keyformat=passphrase -o keylocation=prompt zones/encrypted"

and then add "filesystems": [{"source": "/zones/encrypted/", "target": "/srv", "type": "lofs" }] to your vm json

ah, nice

it's per dataset, however any clones of that dataset must use the same key

which is why there's just one pool level key in triton since everything is based on reference images that are cloned for an instance

but if you're creating brand new datasets for data for an instance, those could have their own keys... just there's nothing plumbed up to manage it

i've got to go AFK, but will read the backlog if any

thanks anyway for all your input

It took a bit to fix issue with endian check in this variant of the code (I have 2 alternates, but I sort of like this one more:D)

Huh, network card stopped update on some past SmartOS upgrade.. and I thought card died and replaced it with new same-chip LAN card and.. new card still is not working. I think there is something wrong with the driver in newer SmartOS/illumos that stoppd detecting the LAN card...

I will try to determine on what PI update it started to happen and card stopped working. (dladm show-phys shows nothing)

what sort of card?

and do you see something in prtconf -d (needs root)?

you should see every PCI device visible on the system there.. if there's not a driver for it, or something happened w/ the driver, you'd see '(driver not attached)'

Also `/usr/lib/pcie/pcieadm show-devs` might be helpful.

And that `dladm show-phys` shows nothing is... interesting.

thanks, will see prtconf -d 1Gbit LAN card, it is Tp-link TG-3468

ver 4.0

I have read RTL8168H from the chip

danmcd, I mean dladm show-phys displays only integrated intel admin interface card, not the RTL card anymore

Realtek... interesting indeed. I wonder what the PCIe ID is? Did it get nuked by accident?!

Aha, maybe I am stupid and didn't change MAC address in /usbkey/config ...

That might do it?!

but yeah, could not without fnding MAC with dladm..

usually it is there in dladm show-phys..

I see it in prtconf -v as : pci10ec,8168 (pciex10ec,8161) [Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller] (driver not attached)

Will find out if bringing back older PI helps determine if it is about that.

fgudin github.com/tsoome/illumos-gate/tree/crypto