Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Does ZFS on Linux already support Encryption? If not, is it planned?

I found tons of info for ZFS+LUKS but that's absolutely uninteresting: I want ZFS encryption so that I can do replication using zfs send to an "untrusted" backup server. I.e., zfs send fragments should be encrypted.

If ZoL does not support encryption, is there a more elegant way other than creating zVols and using LUKS+EXT on top of it (loosing many ZFS advantages)?

share|improve this question
    
zfs send | gpg works well. Don't make things more complicated than you have to. –  Michael Hampton Jul 1 at 4:39
1  
I probably just wouldn't store my backups there... –  ewwhite Jul 1 at 4:40
    
@MichaelHampton: You are right but then on the other hand I can't receive it on the backup target. The idea would be to do zfs send and work completely with inkremental snapshots. From the backup server in turn, the snapshots should again be archived to another location. Or does this still work with GPG too? (BTW: I assume to gpg pipe does not create much overhead right?) –  divB Jul 1 at 6:22
    
@ewwhite: Maybe but you don't know my setup. In any case: It is my own server with own drive (i.e., no WAN/internet). I still want the stuff to be encrypted because it is not stored in the server rack as the server is. –  divB Jul 1 at 6:23

2 Answers 2

No, ZFS on Linux doesn't support native encryption. Another option is encryptfs, but at this juncture, you're not going to find a native solution.

share|improve this answer
    
The post states the reason is that Oracle hasn't released the source. But doesn't FreeBSD support the encryption? Then I wonder why WoL does not ... In any case, thanks for the ecryptfs pointer I will think about it ... –  divB Jul 1 at 6:26
    
Ok, I just see ecryptfs does not support ACLs unfortunately. So no option :-( –  divB Jul 1 at 6:28
    
I thought I'd seen something about FreeNAS' encrypted-ZFS support, but can't readily find it. The take-away of it, however, was that FreeNAS just uses the FreeBSD equivalent of running ZFS on top of LUKS. @divB –  Michael Kjörling Jul 12 at 13:18

Typically for folks using ZoL that want encryption, encryptfs isn't desireable because you lose both performance and fuctionality.

ZFS works best when it is the filesystem, not when you layer others on top of it (again, you can, but it's suboptimal). This is what encryptfs does (layers an encrypted filesystem on top of ZFS), and exactly why you see so much about LUKS (which works the other way around - it can configure ZFS on top of an encrypted container which is managed by the kernel - very performant for what it's doing and you don't lose any ZFS features.

Unforunately, as others have noted, ZoL does in fact not include native filesystem encryption such as in the Oracle implementation at this time. You've got to layer your encryption above (encryptfs) or below (LUKS) the ZFS magic.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.