geli-encrypted pool failed to decrypt after config import (key backup at hand)

[lexik]

Hi,
I had a freenas/truenas installation running in an esxi vm. The disk containing the freenas-vm crashed and I replaced it. I regularly make backups of my freenas config (including encryption keys) and was able to import the config (despite the new installation is a slightly newer version of truenas) and everything came back up fine. Except one encrypted pool.
Under "Storage" -> "Pools" I get the following message: <poolname> (Legacy Encryption) LOCKED This geli-encrypted pool failed to decrypt.
On the right icon (gear), I can just Export/Disconnect the pool.
I have a backup of the geli.key at hand, but I don't have any option to add the geli.key or to enter the password.

How can I manually unlock the pool? Can I somehow import the geli.key so truenas recognizes it and auto-unlocks the pool upon boot?

Should I maybe create a VM with an older Truenas version and try to import my backup there?

Any help is much appreciated!

 

[lexik]

Ok I fixed it myself.

I did the following (maybe it will help some lost google someday):

- I opened the freenas-v1.db with sqliteexplorer to find out the version from which the backup was (look in table system_update)
- I downloaded the appropriate version from download.freenas.org
- I installed a VM with the version, importet the config backup, attached the hba controllers to the vm
- The pool was still locked but now I had the option to unlock with passphrase or key-file (geli.key)
- After uploading the key everything was fine, my bloodpressure made a big drop :) I just love freenas / truenas

Thanks for all the hard work you do!

 

[lexik]

I have one question though: I now have to manually unlock the encrypted pool. How can I save the keyfile "into" truenas so I don't have to unlock the pool manually after reboot?

 

[lexik]

bump

 

[HITMAN]

Maybe this will help you.

Encryption |

Encryption

www.truenas.com

Code:

https://youtu.be/RmJMqacoPw4?t=243

 

[Amir Yalon]

I have one question though: I now have to manually unlock the encrypted pool. How can I save the keyfile "into" truenas so I don't have to unlock the pool manually after reboot?

Maybe this would do it: copy the key file to the right location in /data/geli/. (Read the linked reply for more information on how to find the right location.)