Contents
Can ZFS be encrypted?
ZFS encryption is integrated with the ZFS command set. Like other ZFS operations, encryption operations such as key changes and rekey are performed online. You can use your existing storage pools as long as they are upgraded. You have the flexibility of encrypting specific file systems.
How does ZFS encryption work?
A final note: ZFS doesn’t actually encrypt your data directly with a supplied passphrase; it encrypts your data with a pseudo-randomly generated master-key. Your passphrase unlocks that master-key, which then becomes available for use working with the volume itself!
What is a ZFS volume?
A ZFS volume is a dataset that represents a block device. ZFS volumes are identified as devices in the /dev/zvol/{dsk,rdsk}/pool directory. If you are using a Solaris system with zones installed, you cannot create or clone a ZFS volume in a non-global zone.
What is ZFS deduplication?
What Is ZFS Deduplication? If a file system has the dedup property enabled, duplicate data blocks are removed as they are written to disk. The result is that only unique data is stored on disk and common components are shared between files, as shown in Figure 1.
How do I create an encrypted ZFS dataset?
To create a dataset volume with encryption, use the following command. Replace [MOUNT POINT] with the location of where to mount the encrypted volume, [ZPOOL] with the name of the existing pool to use and [DATASET NAME] with the name to call the new encrypted dataset. Now, you will be asked for a passphrase to use.
Should I use ZFS deduplication?
Conclusion. The decision to use ZFS deduplication or not is almost always a simple cost/benefit analysis. When using deduplication, one needs to plan for at least some extra L2ARC SSD requirements, or better some extra RAM for storing the dedup table in a manner that doesn’t negatively impact write performance.
How is data encrypted in ZFS file system?
Data is encrypted using AES (Advanced Encryption Standard) with key lengths of 128, 192, and 256 in the CCM and GCM operation modes. ZFS encryption uses the Oracle Solaris Cryptographic Framework, which gives it access to any available hardware acceleration or optimized software implementations of the encryption algorithms automatically.
How to use encryption at rest in OpenZFS?
The -o encryption=.. property controls the ciphersuite (cipher, key length and mode). The default is aes-256-ccm, which is used if you specify -o encryption=on. The -o keysource=.. property controls what format the encryption key will be provided as and where it should be loaded from.
What can I do with ZFS without a key?
For instance: a pool can be scrubbed ( zpool scrub ) without the keys, and datasets and snapshots can be listed ( zfs list -rt ). In future releases, zfs send and zfs recv will also work even if the key is not available.
How is encryption inheritable to descendent file systems?
ZFS encryption is inheritable to descendent file systems. A regular user can create an encrypted file system and manage key operations if create, mount , keysource, checksum, and encryption permissions are assigned to him. You can set an encryption policy when a ZFS file system is created, but the policy cannot be changed.