Encryption, SED vs FreeNAS built in, user intervention at reboots and updates?

[Morty NO]

Dear all,

Sorry if this question is a bit n00b'ish. I'm new to FreeNAS. I did read the FreeNAS docs about managing encrypted volumens, but I didn't quite wrap my head around it.

I would like to build a NAS, and I need encryption for data at rest, as the NAS contains customer data. It's a small NAS with about 2TB capacity for a small single-person home office.

I know my way around Trusted Platform Modules (TPMs) and self-encrypting drives (SED). Thus I could build a NAS which handles my encryption needs via a TPM & SEDs. This would be OS-agnostic, i.e. FreeNAS wouldn't need to do anything special.

FreeNAS has encryption built in, which I could use instead. First off, I assume that after every reboot or power cycling, the passphrase must be entered to mount the encrypted volume, to guard against theft of the entire unit. Is that assumption correct?

Next, is there a general recommendation about how to secure data at rest with FreeNAS, i.e. which solution is most commonly used and recommended?

Thank you very much! :)

 

[BigDave]

Here is an interesting read about the pros and cons, well to be honest it's mostly cons,
but hey, encryption is a boitch
@DrKK is a respected, long standing member and and a humorous, but at the same time
a no nonsense kinda guy. What I'm trying to say is that I have heeded his advice on many,
many occasions ;)

https://forums.freenas.org/index.php?threads/theft-proof-device.44387/#post-298998

 

[anodos]

Is the encryption a legal requirement? A client's requirement? Something that you want because it's cool and/or mitigates $threat?

In the latter case. I recommend reviewing what sort of threat model you're considering where encryption of data at rest is necessary. For reference, my threat model for stuff at home is as follows:

Encrypting data at rest safely can really suck up a lot of time. and if you screw up you jeopardize your client's data. This is not to say that all you need are strong passwords and you're good. Protecting data at rest is something like CSC 13 in the SANS Top 20, but it doesn't make a ton of sense in a small single-person home office.

http://scholar.harvard.edu/files/mickens/files/thisworldofours.pdf

 

[fta]

I have no idea why people are so afraid of the geli encryption that freenas uses. It works fine and has virtually no overhead on modern hardware. It only has the minor inconvenience of having to put in the passphrase to mount the pool every time you boot. DrKK considers encrypting an entire device foolish. I consider DrKK's approach foolish. Take your pick.

 

[Morty NO]

Thank you all for your answers. :)

 

[Robert Smith]

FreeNAS supports nether SED or TPM. If this is the way you want to go you will have to use something other than FreeNAS.

https://forums.freenas.org/index.php?threads/tpm-and-freenas.17441/

https://forums.freenas.org/index.ph...00nm0063-sas-sed-security-settings-how.16290/

 

[cyberjock]

I have no idea why people are so afraid of the geli encryption that freenas uses. It works fine and has virtually no overhead on modern hardware. It only has the minor inconvenience of having to put in the passphrase to mount the pool every time you boot. DrKK considers encrypting an entire device foolish. I consider DrKK's approach foolish. Take your pick.

Yeah, because you haven't hit the encryption bugs. I've personally seen 5+ users lose all of their data because of encryption bugs in the last year alone. I personally saw an encryption user go offline over the 4th of July weekend because of encryption bugs.

So DrKK's comments are totally with merit and should be strongly considered. Not many encrypt, and those that do end up doing so at their own peril since its not well-used-and-abused code.

 

[depasseg]

I have no idea why people are so afraid of the geli encryption that freenas uses. It works fine and has virtually no overhead on modern hardware. It only has the minor inconvenience of having to put in the passphrase to mount the pool every time you boot. DrKK considers encrypting an entire device foolish. I consider DrKK's approach foolish. Take your pick.

People aren't afraid of the day to day use of encryption, it seems like disk failure/replacement is the big issue. Freenas makes it easy (unfortunately) for a user to accidentally lose their encrypted pool.

Read this from @jkh: https://forums.freenas.org/index.php?threads/10-x-encryption.38979/#post-238723

 

[DrKK]

Just for the record, my point isn't that geli encryption is bad, or that it doesn't work, or what not. I am just making a business calculus here---I think it brings almost zero realistic protection to the table, and it very, very clearly brings some risk (primarily due to endemic user incompetence, inexperience, or laziness). So I am not fan because the calculus shows negative expected value. In my view.

But as the gentlemen says, opinions vary. Mine is one voice among many, and the end user will have to ascribe whatever weight he deems appropriate to it.

 

[Morty NO]

FreeNAS supports nether SED or TPM. If this is the way you want to go you will have to use something other than FreeNAS.

Thank you for your answer. :) I have just a quick clarification, in case someone else finds this thread via a Google Search later on.

I believe you are correct that FreeNAS cannot manage TPM settings and SED keys for you, as described in the links you provided.

But I do think it's possible to install FreeNAS on a PC with a TPM, and SATA SEDs, and "ATA Security" set and managed via a BIOS boot password. In the latter scenario, the user has to enter a BIOS password on every boot, and once this is done the operating system (FreeNAS) just sees regular SATA harddisk drives, without knowing that they're actually encrypted at a lower ("hardware") level. I'm no FreeNAS expert, but this works with every other modern OS that I know of, so I do assume it works with FreeNAS too.

 

[Morty NO]

I've personally seen 5+ users lose all of their data because of encryption bugs in the last year alone.

Thank you very much. :) Your answer, together with the other answers, have made my decision clear for me.

 

[Morty NO]

People aren't afraid of the day to day use of encryption, it seems like disk failure/replacement is the big issue. Freenas makes it easy (unfortunately) for a user to accidentally lose their encrypted pool.

Read this from @jkh: https://forums.freenas.org/index.php?threads/10-x-encryption.38979/#post-238723

Great answer, thank you. :)

 

[Robert Smith]

Thank you for your answer. :) I have just a quick clarification, in case someone else finds this thread via a Google Search later on.

I believe you are correct that FreeNAS cannot manage TPM settings and SED keys for you, as described in the links you provided.

But I do think it's possible to install FreeNAS on a PC with a TPM, and SATA SEDs, and "ATA Security" set and managed via a BIOS boot password. In the latter scenario, the user has to enter a BIOS password on every boot, and once this is done the operating system (FreeNAS) just sees regular SATA harddisk drives, without knowing that they're actually encrypted at a lower ("hardware") level. I'm no FreeNAS expert, but this works with every other modern OS that I know of, so I do assume it works with FreeNAS too.

ATA Securuty in practice has been geared towards single disk laptops, and not developed much in recent years.

Instead, Opal and its enterprise and vendor implementations (TCG-E, eDrive) are gaining traction, which tie in more on the management software side.

Motherboard support for these new frameworks, if any, will likely be UEFI based.

Some host bus adapters support some self-encrypting drives in integrated mode; but this does no good for FreeNAS, as FreeNAS needs direct access to disks.

 

[fta]

Yeah, because you haven't hit the encryption bugs. I've personally seen 5+ users lose all of their data because of encryption bugs in the last year alone. I personally saw an encryption user go offline over the 4th of July weekend because of encryption bugs.

Prove it.

Now that I've challenged the status quo, let the condescension begin!

 

[anodos]

Prove it.

Now that I've challenged the status quo, let the condescension begin!

noob :p

 

[Robert Trevellyan]

I've challenged the status quo

<reaching for pitchfork and torch>

 

[cyberjock]

Prove it.

Now that I've challenged the status quo, let the condescension begin!

I don't have to prove anything to you. How the hell would you even *want* me to prove it, assuming I could.

 

[JoshDW19]

We've used GELI encryption in PC-BSD with pretty great success. I can't argue any of the more technical points with you on why it's failed for some customers cyberjock, but I can tell you we have PC-BSD systems in production that have used it for years with no problems. One way you can show proof Cyberjock is by showing tickets that demonstrate the behavior you are speaking about. Let's make sure these tickets that show GELI encryption is causing a lot of bugs / problems are pointed to the proper devs and I'd encourage you to loop in Kris Moore so we can get these knocked out quick. It's not a bad thing for someone to ask for proof in my opinion if someone is offering a technical opinion on a subject. Ad hominem attacks / flaming someone for disagreeing is a logical fallacy. Let's keep the discussion constructive and work on improving FreeNAS if this is indeed a substantive issue everyone :).

 

[cyberjock]

The problem isn't that geli is broken or anything. The problem is that the FreeNAS middleware isn't well maintained with relation to encryption.

The tickets that I have are internal iXsystems tickets. So as I said, I have nothing to prove and have no intention of making internal customer data public.

Edit: And to be frank, if you're going to need me to "prove myself" with something as silly as encryption, you should simply add me to your "ignore" list so you never see my posts, because clearly you should simply ignore *everything* I say. If you're going to decide I'm an idiot or say things that are totally baseless, you can't be discriminatory about what I say. Either I'm an idiot or I'm not.

 

[anodos]

Either I'm an idiot or I'm not.

I'm sure we can find some sort of middle ground there. :D