Encryption and replication TrueNAS core 12

[wavesswe]

Hi!

I have a TrueNAS system with legacy encryption doing replication task to a TrueNAS system with new type encryption pool. But I think that the data is unencrypted. I have a lock with prohibit sign icon next to the dataset.

if this indicates unencryption.

how do I solve this in the best way? I want to secure the data and not risk locking my self out.

 

[winnielinnie]

if this indicates unencryption.

That icon means the dataset is not encrypted, even though it is nested underneath an encrypted dataset.

You would have to make use of the "-x encryption" flag on the recv side of the replication, so that the newly created (and incrementally updated) dataset uses the encryption properties from its parent on the destination.

Similar problem seen here: https://www.truenas.com/community/threads/help-moving-pool-to-new-disks.89555/

And here: https://www.truenas.com/community/t...-drive-encryption-migration.89337/post-618435

 

[wavesswe]

Ok, is this an option from the GUI or CMD only? And will it be the same if i would recreate the pool from main server with the new encryption?

and also will it work if i encrypt the datasets with the replications on the backup and then transfer them back to main truenas with a newley created pool?

 

[Samuel Tai]

That icon means the dataset is not encrypted, even though it is nested underneath an encrypted dataset.

@winnielinnie, I don’t think that’s correct. For my encrypted datasets, the lack of a lock icon on a daughter dataset underneath an encrypted dataset with a lock just means the daughter is inheriting the parent’s encryption settings.

 

[winnielinnie]

I have a lock with prohibit sign icon next to the dataset.

That icon means the dataset is not encrypted, even though it is nested underneath an encrypted dataset.

@winnielinnie, I don’t think that’s correct. For my encrypted datasets, the lack of a lock icon on a daughter dataset underneath an encrypted dataset with a lock just means the daughter is inheriting the parent’s encryption settings.

@Samuel Tai, I believe you might have misread our posts. Without posting actual icon image files (of which I attempted to do), it's not as clear. I was referring to the padlock icon with the "X" (aka "prohibit) sign.


I'll try to clarify again, and if anyone knows how to insert official TrueNAS GUI icons/elements in this forum, let me know!

UPDATE: I went ahead and uploaded some icons I cropped out of the GUI, to better illustrate what I was referring to:

• 
  Padlock icon = encrypted dataset (parent / "encryptionroot" of children who inherit this dataset's encryption properties)
• 
  Padlock icon with an X = non-encrypted dataset, that is nested underneath an encrypted dataset or child
• 
  Lack of icon = dataset is inheriting its encryption properties from the parent / "encryptionroot"

 

[winnielinnie]

Ok, is this an option from the GUI or CMD only?

In the Replication Tasks, there is an option for "Encryption" that I believe is what you are looking for?

And will it be the same if i would recreate the pool from main server with the new encryption?

and also will it work if i encrypt the datasets with the replications on the backup and then transfer them back to main truenas with a newley created pool?

Both are possible sending as a raw encrypted stream. In the command line, you would use the -R and -w flags. However, for the GUI, I believe the same is accomplished with the "Full Filesystem Replication" option, which preserves the dataset's properties, and includes all previous snapshots.

 

[Samuel Tai]

• View attachment 44625 Padlock icon = encrypted dataset (parent / "encryptionroot" of children who inherit this dataset's encryption properties)
• View attachment 44626 Padlock icon with an X = non-encrypted dataset, that is nested underneath an encrypted dataset or child
• View attachment 44627 Lack of icon = dataset is inheriting its encryption properties from the parent / "encryptionroot"

OK, this makes more sense. Thanks, @winnielinnie.

 

[wavesswe]

I now tried and it’s WIP as I write this with a small dataset and it seams that it’s working. I picked hex as encryption and from what I understand this is now stored in the backup server. How ever I needed to create a new data set on the remote location. Is this the only way or can I encrypt the already moved data? It’s a lot to re-move