Storage Encryption

Always consider the following drawbacks/considerations when encrypting data:

• Losing encryption keys and passwords means losing your data.
• Unrelated encrypted datasets do not support deduplication.
• We do not recommend using GELI or ZFS encryption with deduplication because of the sizable performance impact.
• Be cautious when using many encryption and deduplication features at once since they all compete for the same CPU cycles.

The parent dataset is media. It has three child datasets. The documents child dataset has inherited the parent encryption settings and password. The other two child datasets (audio and video) have their own passphrases. When the parent dataset is locked, all child datasets lock too.

Open the more_vert for the parent dataset and select unlock. To unlock all the datasets, check the Unlock Children and enter the passphrase for each dataset that needs to be unlocked.

Click the Continue button in the dialog window that confirms that the unlocking was successful. The dataset listing changes to show the unlocked icon.

Creating a new encrypted pool automatically generates a new key file and prompts you to download it.

Manually download a copy of the inherited and non-inherited encrypted dataset keyfiles for the pool by opening the pool settings menu and selecting Export Dataset Keys. Enter the root password and click the CONTINUE button.

To manually download a back up of a single keyfile for the dataset, click the dataset more_vert and select Export Key. Enter the root password and click the CONTINUE button. Click the DOWNLOAD KEY button.

To change the key, click the dataset more_vert and Encryption Options.

Enter your custom key or click Generate Key.

The passphrase is the only means to decrypt the information stored in a dataset using passphrase encryption keys. Be sure to create a memorable passphrase or physically secure the passphrase.

To use a passphrase instead of a keyfile, click the dataset more_vert and Encryption Options. Change the Encryption Type from Key to Passphrase.

Set the rest of the options:

• Passphrase is a user-defined string used to decrypt the dataset. Can use instead of an encryption key. Must be longer than 8 characters.
• pbkdf2iters is the number of password-based key derivation function 2 (PBKDF2) iterations to use for reducing vulnerability to brute-force attacks. Entering a number greater than 100000 is required.

1. Replicate every encrypted dataset you want to replicate with properties.
2. Export key for every child dataset which has a unique key.
3. For each child dataset construct a proper json with poolname/datasetname of the destination system and key from the source system like this: {"tank/share01": "57112db4be777d93fa7b76138a68b790d46d6858569bf9d13e32eb9fda72146b"}
4. Save this file with the extension .json.
5. On remote system unlock the dataset(s) using properly constructed json files.

Uncheck properties when replicating so that the destination dataset is not be encrypted on the remote side and does not require a key to unlock.

1. Go to Tasks > Replication Tasks and click ADD.
2. Click ADVANCED REPLICATION CREATION.
3. Fill out the form as needed and make sure Include Dataset Properties is NOT checked.
4. Click SUBMIT.

GELI encrypted pools continue to be detected and supported in the TrueNAS web interface as Legacy Encrypted pools. As of TrueNAS version 12.0-U1, a decrypted GELI pool can migrate data to a new ZFS encrypted pool using the Replication Wizard.

Start the Replication Wizard by selecting Tasks > Replication Task > ADD

Source Location:

• Select On this System.
• Set the dataset to transfer.

Destination Location:

• Select On a Different System.

SSH Connection:

• Either created the ssh connection by clicking Create New or select the destination system ssh connection.
• In Destination, select the dataset to replicate the files to.
• Select Encryption.
• Select either PASSPHRASE or HEX as the Encryption Key Format.
• If you selected PASSPHRASE, enter the passphrase. If you selected HEX, set Generate Encryption Key.
• Select Store Encryption key in Sending TrueNAS database.
• Click Next

Replication Schedule:

• Select Run Once in Replication Schedule.

• Clear the checkmark in Make Destination Dataset Read-Only.

• Click START REPLICATION

This method does not preserve file ACLs.

The web interface supports using Tasks > Rsync Tasks to transfer files out of the GELI pool. In the Shell, rsync and other file transfer mechanisms (scp, cp, sftp, ftp, rdiff-backup) are available for copying data between pools.

These instructions are an example walk-through. It is not an exact step-by-step guide for all situations. Research ZFS send/receive before attempting this. A simple example cannot cover every edge case.

Legend:

• GELI pool = pool_a
• Origin dataset = dataset_1
• Latest snapshot of GELI pool = snapshot_name
• ZFS native-encrypted pool = pool_b
• Receieving dataset = dataset_2

1. Create a new encrypted pool in Storage > Pools.
2. Open the Shell. Make a new snapshot of the GELI pool and dataset with the data to migrate. Enter command: zfs snapshot -r pool_a/dataset_1@snapshot_name.
3. Create a passphrase: echo passphrase > /tmp/pass.
4. Use ZFS send/receive to transfer the data between pools. Enter command: zfs send -Rv pool_a/dataset_1@snapshot_name | zfs recv -o encryption=on -o keyformat=passphrase -o keylocation=file:///tmp/pass pool_b/dataset_2.
5. After the transfer completes, go to Storage > Pools and lock the new dataset. After locking the dataset, immediately unlock it. TrueNAS prompts for the passphrase. After entering the passphrase and unlocking the pool, you can delete the /tmp/pass file used for the transfer.
6. If desired, you can convert the dataset to use a keyfile instead of a passphrase. To use a key file, click the dataset   (Options) and click Encryption Options. Change the Encryption Type from Passphrase to Key and save. Back up your key file immediately!
7. Repeat this process for every dataset in the pool that you need to migrate.