I've had a similar problem, which I solve by only encrypting /home. The trouble is /etc/rc.d/geli wants to mount it before continuing with the boot. A kludge would be the do the mount manually post-boot, but I like the way in which it proposes to do it at boot time - I just want the network to start first, since /, /var and /usr aren't encrypted.
I thus put this:
/dev/ada0p7.eli /home ufs rw,noauto 0 0
in /etc/fstab
Created matching "l" options in rc.conf:
lgeli_devices="ada0p7"
lgeli_ada0p7_flags="-k /etc/geli/server.key"
lgeli_ada0p7_autodetach="NO"
and then lgeli in /etc/rc.d, like so:
#!/bin/sh
# PROVIDE: lgeli
# REQUIRE: sshd
# KEYWORD: nojail
. /etc/rc.subr
lgeli_make_list()
{
local devices devices2
local provider
devices="${lgeli_devices}"
for provider in ${devices}; do
provider=${provider%.eli}
provider=${provider#/dev/}
devices2="${devices2} ${provider}"
done
echo ${devices2}
}
name="lgeli"
start_precmd='[ -n "$(lgeli_make_list)" ]'
start_cmd="lgeli_start"
stop_cmd="lgeli_stop"
required_modules="geom_eli:g_eli"
lgeli_start()
{
devices=`lgeli_make_list`
if [ -z "${lgeli_tries}" ]; then
if [ -n "${lgeli_attach_attempts}" ]; then
# Compatibility with rc.d/gbde.
lgeli_tries=${lgeli_attach_attempts}
else
lgeli_tries=`${SYSCTL_N} kern.geom.eli.tries`
fi
fi
for provider in ${devices}; do
provider_=`ltr ${provider} '/-' '_'`
eval "flags=\${lgeli_${provider_}_flags}"
if [ -z "${flags}" ]; then
flags=${lgeli_default_flags}
fi
if [ -e "/dev/${provider}" -a ! -e "/dev/${provider}.eli" ]; then
echo "Configuring Disk Encryption for ${provider}."
count=1
while [ ${count} -le ${lgeli_tries} ]; do
geli attach ${flags} ${provider}
if [ -e "/dev/${provider}.eli" ]; then
# LOUIS line below, so long as
# /etc/fstab... noauto line
# present, this works
mount "/dev/${provider}.eli"
break
fi
echo "Attach failed; attempt ${count} of ${lgeli_tries}."
count=$((count+1))
done
fi
done
}
lgeli_stop()
{
devices=`lgeli_make_list`
for provider in ${devices}; do
if [ -e "/dev/${provider}.eli" ]; then
umount "/dev/${provider}.eli" 2>/dev/null
geli detach "${provider}"
fi
done
}
load_rc_config $name
run_rc_command "$1"
This way, it's fairly clean, and not too much of a kludge. The mount command in lgeli ensures that the noauto stuff is mounted if geli'd. A bit ugly, but to me the main thing is, I can log in remotely and rescue my desktop from being inaccessible after a power failure, which was the default mode otherwise!