PVE mit ZFS und native encryption - Versionsgeschichte

Neobiker: /* key_zfs.conf */

2025-11-09T16:43:09Z

key_zfs.conf

← Nächstältere Version		Version vom 9. November 2025, 18:43 Uhr
Zeile 153:		Zeile 153:
	# - manually with a different(!) password ==> if the USB_STICK is defect		# - manually with a different(!) password ==> if the USB_STICK is defect

	# name of encrypted ZFS ~~volume~~		# name of encrypted ZFS volumes
	ENC_ZFSVOL="rpool/encrypted_data hddpool/encrypted_data"		ENC_ZFSVOL="rpool/encrypted_data hddpool/encrypted_data"

2025-11-09T16:42:22Z

Install ZFS-KEY on USB-Stick

← Nächstältere Version		Version vom 9. November 2025, 18:42 Uhr
Zeile 78:		Zeile 78:

	<pre>root# ls /dev/disk/by-id/usb*:0		<pre>root# ls /dev/disk/by-id/usb*:0
	/dev/disk/by-id/usb-~~FLASH_Drive_SM_USB20_AA09012700007506~~-0:0		/dev/disk/by-id/usb-Memorybird_P_100074AE3400109-0:0

	root# vi key_zfs.conf # ~~usb-FLASH.. in~~ USB_STICK= variable ~~schreiben~~		root# vi key_zfs.conf # USB_STICK= variable
			USB_STICK=usb-Memorybird_P_100074AE3400109-0:0

	root# . key_zfs.conf		root# . key_zfs.conf
Zeile 88:		Zeile 89:

	root# ls -l $USB_STICK		root# ls -l $USB_STICK
	-rw------- 1 root root 130 Nov 9 16:43 usb-~~FLASH_Drive_SM_USB20_AA09012700007506~~-0:0		-rw------- 1 root root 130 Nov 9 16:43 usb-Memorybird_P_100074AE3400109-0:0

	root# dd if=${USB_STICK} of=/dev/disk/by-id/${USB_STICK} bs=${USB_BSIZE} count=${USB_COUNT} seek=${USB_SKIP}		root# dd if=${USB_STICK} of=/dev/disk/by-id/${USB_STICK} bs=${USB_BSIZE} count=${USB_COUNT} seek=${USB_SKIP}

2025-11-09T16:40:19Z

keymanager_zfs.sh

← Nächstältere Version		Version vom 9. November 2025, 18:40 Uhr
Zeile 195:		Zeile 195:
	=== keymanager_zfs.sh ===		=== keymanager_zfs.sh ===
	Das Key Management Tool habe ich in einem Forum gefunden: [https://forums.gentoo.org/viewtopic-t-1122263-start-0.html keymanager.sh]		Das Key Management Tool habe ich in einem Forum gefunden: [https://forums.gentoo.org/viewtopic-t-1122263-start-0.html keymanager.sh]
			und geringfügig angepasst.
	<pre>#!/bin/bash		<pre>#!/bin/bash
	# zfs multiple passwords		# zfs multiple passwords

2025-11-09T16:39:45Z

keymanager_zfs.sh

← Nächstältere Version		Version vom 9. November 2025, 18:39 Uhr
Zeile 246:		Zeile 246:
	key="KEY${key:0:$keysize}"		key="KEY${key:0:$keysize}"
	[ -e ${store}/${keyname} ] && echo Key exists. I will not overwrite ${store}/${keyname} && exit 252		[ -e ${store}/${keyname} ] && echo Key exists. I will not overwrite ${store}/${keyname} && exit 252
			mkdir -p $(dirname ${store}/${keyname})
	if [ -z $pass ] ; then		if [ -z $pass ] ; then
	openssl enc -aes-256-cbc -a -pbkdf2 -iter 1000000 <<< ${key} > ${store}/${keyname}		openssl enc -aes-256-cbc -a -pbkdf2 -iter 1000000 <<< ${key} > ${store}/${keyname}
Zeile 416:		Zeile 417:

	[ -e ${store}/${newkeyname} ] && echo New key exists. I will not overwrite ${store}/${newkeyname} && exit 252		[ -e ${store}/${newkeyname} ] && echo New key exists. I will not overwrite ${store}/${newkeyname} && exit 252
			mkdir -p $(dirname ${store}/${newkeyname})
	if [ -z $newpass ] ; then		if [ -z $newpass ] ; then
	echo Encrypting key		echo Encrypting key

2025-11-09T16:32:54Z

keymanager_zfs.sh

← Nächstältere Version		Version vom 9. November 2025, 18:32 Uhr
Zeile 456:		Zeile 456:
	echo " Makes a key previously generated by makekey available to anotheruser."		echo " Makes a key previously generated by makekey available to anotheruser."
	echo " That is, decrypts the key saved under keyname using password, then"		echo " That is, decrypts the key saved under keyname using password, then"
	echo " saves it under newkeyname ~~encryoted~~ by using newpass"		echo " saves it under newkeyname encrypted by using newpass"
	echo " Password is used to decrypt key. If password is not given, it "		echo " Password is used to decrypt key. If password is not given, it "
	echo " will be requested from stdin."		echo " will be requested from stdin."

2025-11-09T15:56:43Z

ZFS Volume in PVE Storage einbinden

← Nächstältere Version		Version vom 9. November 2025, 17:56 Uhr
Zeile 97:		Zeile 97:

	=== ZFS Volume in PVE Storage einbinden ===		=== ZFS Volume in PVE Storage einbinden ===
	<pre>root# pvesm add zfspool local_encrypted -pool rpool/encrypted_data</pre>		<pre>root# pvesm add zfspool local_encrypted -pool rpool/encrypted_data

			root# pvesm status
			Name Type Status Total Used Available %
			local dir active 865753984 128 865753856 0.00%
			local-zfs zfspool active 899603948 33850088 865753860 3.76%
			local_encrypted zfspool active 865754052 192 865753860 0.00%
			</pre>

	= Files =		= Files =

2025-11-09T15:50:45Z

ZFS Volume in PVE Storage einbinden

← Nächstältere Version		Version vom 9. November 2025, 17:50 Uhr
Zeile 97:		Zeile 97:

	=== ZFS Volume in PVE Storage einbinden ===		=== ZFS Volume in PVE Storage einbinden ===
	<pre>root# pvesm add zfspool ~~encrypted-zfs~~ -pool rpool/encrypted_data</pre>		<pre>root# pvesm add zfspool local_encrypted -pool rpool/encrypted_data</pre>

	= Files =		= Files =

2025-11-09T15:48:43Z

ZFS Volume in PVE Storage einbinden

← Nächstältere Version		Version vom 9. November 2025, 17:48 Uhr
Zeile 97:		Zeile 97:

	=== ZFS Volume in PVE Storage einbinden ===		=== ZFS Volume in PVE Storage einbinden ===
	<pre>pvesm add zfspool encrypted-zfs -pool rpool/encrypted_data</pre>		<pre>root# pvesm add zfspool encrypted-zfs -pool rpool/encrypted_data</pre>

	= Files =		= Files =

2025-11-09T15:47:42Z

Unlock encrypted ZFS Pool

← Nächstältere Version		Version vom 9. November 2025, 17:47 Uhr
Zeile 64:		Zeile 64:
	rpool/encrypted_data keystatus available -		rpool/encrypted_data keystatus available -
	Key already loaded, nothing to do		Key already loaded, nothing to do

	root# zfs get keystatus		root# zfs get keystatus
	NAME PROPERTY VALUE SOURCE		NAME PROPERTY VALUE SOURCE

2025-11-09T15:47:08Z

encrypted ZFS Volume anlegen

← Nächstältere Version		Version vom 9. November 2025, 17:47 Uhr
Zeile 53:		Zeile 53:
	<pre>root# ./keymanager_zfs.sh zfscreate -v rpool/encrypted_data		<pre>root# ./keymanager_zfs.sh zfscreate -v rpool/encrypted_data
	enter AES-256-CBC decryption password:		enter AES-256-CBC decryption password:

	root# zfs list rpool/encrypted_data		root# zfs list rpool/encrypted_data
	NAME USED AVAIL REFER MOUNTPOINT		NAME USED AVAIL REFER MOUNTPOINT