FreeNAS will not decrypt through Storage tab

[Opti]

Hi all,

Something distrubing happened on my FreeNAS box tonight and I wanted to discuss it here to see if it was a bug or just user error.

I am was running FreeNAS 8.3.1-BETA3 and recently upgraded to 8.3.1-RC1 through the GUI.
My System is:

Intel Core i3-3220T
16 GB RAM
2 x 2TB HD in Raid Z2 with FDE

After the upgrade I auto-imported my volumes and used the GELI key and the paraphrase to decrypt and get running again and everything worked great. I haven't rebooted my NAS for weeks until tonight. After the reboot it wouldn't accept my paraphrase to decrypt the drives and gave the following error in the console messages:

Code:

Mar 19 20:07:54 freenas manage.py: [middleware.exceptions:38] [MiddlewareError: Volume could not be imported: 3 devices failed to decrypt]

I tried the GELI key and a combination of both and rebooting but got the same error each time. A grey pop-up box would also display something to the effect of the password is incorrect.

In my haste I tried an auto-import again with the same paraphrase and key which seemed to decrypt the volume (as seen through the console messages) but would not mount as I hadn't removed the previous volume and so it wouldn't have two with the same name.

I then tried decrypting one more time from the Storage tab with just the paraphrase. It again stated the GELI key was incorrect, displayed the grey pop-up box saying an error had occured and then all my drives displayed and were usable again.

So from what I can tell it wouldn't let me decrypt from the storage tab. I managed to decrypt via auto-import then when I tried again through the storage tab it threw an error since the drives were already decrypted and all it had to do was mount them. Needless to say I am worried that the next time I power cycle the machine I won't be able to decrypt my drives.

 

[William Grzybowski]

What GELI key? The Recovery key?

 

[Opti]

Yes the recovery key or global GELI key that you download through the admin page

 

[William Grzybowski]

There was a bug in BETA3 that would reset the recovery key if you download it before setting a passphrase or somesuch

 

[Opti]

Hmmm I'll try redownloading the key. But I have decrypted with the one I have now before and it has worked. Plus I used it for the auto-import after my upgrade.

 

[Opti]

Ok so I tried re-downloading the GELI key and it downloads an empty file 0 bytes? any suggestions

 

[William Grzybowski]

That is weird... How did you upgrade from BETA3 to RC1? From GUI? Or fresh install + upload config?

You can use the re-key function in the GUI to regenerate the key.

 

[Opti]

I updated via the GUI

Thanks for the re-key info it seemed to work and now I can download a proper GELI key file again. Once I have backed up the important stuff I will try rebooting and decrypting my drives.

 

[Opti]

Well using the re-key feature only half worked. Now if I:

• decrypt using the paraphrase it decrypts appropriately
• decrypt using the recovery key and paraphrase it decrypts appropriately
• decrypt using the recovery key only it does not decrypt and gives the following error:

Code:

Mar 28 18:56:17 freenas manage.py: [storage.forms:1784] 
Mar 28 18:56:17 freenas manage.py: [middleware.notifier:1200] Failed to geli attach gptid/4ae36218-7105-11f2-8449-78931e67e78a: geli: Wrong key for gptid/4ae36218-7105-11f2-8449-78931e67e78a.
Mar 28 18:56:17 freenas manage.py: [middleware.notifier:1200] Failed to geli attach gptid/4ae36218-7105-11f2-8449-78931e67e78a: geli: Wrong key for gptid/4ae36218-7105-11f2-8449-78931e67e78a.
Mar 28 18:56:18 freenas manage.py: [middleware.notifier:1200] Failed to geli attach gptid/4ae36218-7105-11f2-8449-78931e67e78a: geli: Wrong key for gptid/4ae36218-7105-11f2-8449-78931e67e78a.
Mar 28 18:56:18 freenas manage.py: [middleware.exceptions:38] [MiddlewareError: Volume could not be imported: 3 devices failed to decrypt]

So the problem seems to be with the recovery key. Is there any way I can check that the one I am downloading from the administration site is correct?

Any other suggestions? Otherwise I am going to upgrade to the release version and see how that goes. Hopefully this issue is fixed in the release, but I am not holding my breath

 

[William Grzybowski]

Recovery key and passphrase makes no sense, it will just use passphrase...

Your recovery key is not working, it is invalidated once you rekey you change passphrase, create the recovery key again.

 

[Opti]

Recovery key and passphrase makes no sense, it will just use passphrase...

Yea I figured that's what was happening.

Your recovery key is not working, it is invalidated once you rekey you change passphrase, create the recovery key again.

Sorry I don't quite understand this. I used the re-key feature in the GUI to crete a new recovery key (the GELI key file). I am now using this new recovery key to try to decrypt my drives and it is not working.

The paraphrase however has never been changed and is still the same. It was also not decrypting the drives prior to the me using the re-key feature. Since creating a new recover key the paraphrase is working to decrypt the drives.

However the new recovery key I created is still not decrypting the drives