How to activate TCG on a Harddrive?

[Grinchy]

Hello,

since 11.1 U5 there's a integration of Self-Encrypting Drives in FreeNAS.

My HGST 8TB Drives Support TCG Enterprise so I'm thinking about using this on my System. I was quiet afraid of using geli, cause there are some Horror Story on this Forum where User lost all there Data. Also there are a lot people who don't recommend to use it on a productive System.

But TCG sounds really nice. My Drives are encrypting everything anyway, so why not to set a PW and make the encryption real? I really like the idea :)

So my question is, how can I set an Password with my TCG Drives to use the encryption? My Supermicro X11SM-F doesn't seems to support this out of the BIOS Settings..

I already tried it with "sedutil-cli --initialsetup PW /dev/ada0", but it seems it can't access the drive. Do i need to remove the Pool to put it on, or is there a other Problem i don't know?


Would be great if someone could help me in this case. Thank you!

 

[Chris Moore]

Understand that if something goes wrong with the configuration, a self encrypting drive might reset it's internal cryptographic key and nobody will be able to access the data. Just like geli, you still have a risk of data loss. You have to decide if you want to secure your data from loss (you not being able to get it) or secure it against other people getting access to it if they steel your server.

 

[Chris Moore]

Here is some light reading to start:
https://www.trustedcomputinggroup.org/wp-content/uploads/TCG_PCClientImplementation_1-21_1_00.pdf