From owner-freebsd-questions@FreeBSD.ORG Thu Feb 27 06:13:46 2014 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 478F136C for ; Thu, 27 Feb 2014 06:13:46 +0000 (UTC) Received: from www81.your-server.de (www81.your-server.de [213.133.104.81]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 03D4F1AD0 for ; Thu, 27 Feb 2014 06:13:45 +0000 (UTC) Received: from [188.108.252.211] (helo=michael-think) by www81.your-server.de with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.74) (envelope-from ) id 1WItqr-0004kE-9Z; Thu, 27 Feb 2014 06:49:45 +0100 Content-Type: text/plain; charset=iso-8859-15; format=flowed; delsp=yes To: "FreeBSD Questions" , Polytropon Subject: Re: Simple disk encryption for off-site backup References: <20140227045904.5ba67227.freebsd@edvax.de> Date: Thu, 27 Feb 2014 06:49:38 +0100 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: "Michael Ross" Message-ID: In-Reply-To: <20140227045904.5ba67227.freebsd@edvax.de> User-Agent: Opera Mail/1.0 (Win32) X-Authenticated-Sender: gmx@ross.cx X-Virus-Scanned: Clear (ClamAV 0.97.8/18520/Thu Feb 27 04:41:43 2014) X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Feb 2014 06:13:46 -0000 On Thu, 27 Feb 2014 04:59:04 +0100, Polytropon wrote: > I'm planning to add a new disk next month to my home setup. > It should be an external USB disk for off-site (really!) > backup. That's why I would like to see the content encrypted. > I have no problem with entering a long passphrase when mounting > the disk for backup or restore operations, and probably I would > not feel safe enough by just using keys (stored somewhere). > The file system will be UFS, so there is no need to worry that > some other OS or "Windows" would not be able to read it. :-) > > My question is: What is the _easiest_ mechanism to initialize > a disk for encrypted use? It should work with FreeBSD 9 and 10 > in the first place. > > I am using geli for that. Copied from the man page: Initialize a provider which is going to be encrypted with a passphrase and random data from a file on the user's pen drive. Use 4kB sector size. Attach the provider, create a file system, and mount it. Do the work. Unmount the provider and detach it: # dd if=/dev/random of=/mnt/pendrive/da2.key bs=64 count=1 # geli init -s 4096 -K /mnt/pendrive/da2.key /dev/da2 Enter new passphrase: Reenter new passphrase: # geli attach -k /mnt/pendrive/da2.key /dev/da2 Enter passphrase: # dd if=/dev/random of=/dev/da2.eli bs=1m # newfs /dev/da2.eli # mount /dev/da2.eli /mnt/secret ... # umount /mnt/secret # geli detach da2.eli Regards, Michael