Lock an Encrypted Dataset

[mro]

I have started to ZFS Snapshot Replicate an Encrypted Dataset to another Truenas core box.

I unlocked the remote dataset. I can’t figure out how to lock it again. How do I do this ?

 

[winnielinnie]

Is it a passphrase protected dataset or did you use a keyfile?

 

[mro]

Is it a passphrase protected dataset or did you use a keyfile?

Key File that i took from the Source Truenas Box

 

[winnielinnie]

Key File that i took from the Source Truenas Box

From my experience, once unlocked, the only way to re-lock an encrypted dataset that uses a keyfile is to disconnect the pool. Until then, the keyfile lives on the boot pool. For passphrase protected datasets, you can lock them at will.

 

[mro]

From my experience, once unlocked, the only way to re-lock an encrypted dataset that uses a keyfile is to disconnect the pool. Until then, the keyfile lives on the boot pool. For passphrase protected datasets, you can lock them at will.

Oh well thats not a good design. Thanks for the info.

 

[Samuel Tai]

I don’t believe that’s actually the case. There’s a pull-down menu at the right of the dataset underneath the 3 dots, and there should be a “Lock” option in that menu for an unlocked dataset.

 

[mro]

I don’t believe that’s actually the case. There’s a pull-down menu at the right of the dataset underneath the 3 dots, and there should be a “Lock” option in that menu for an unlocked dataset.

Could not see that at all

 

[winnielinnie]

Oh well thats not a good design. Thanks for the info.

Agreed.

I can understand the justification for preventing the top-level root dataset from being locked if the System Dataset (.system) resides on that pool. Hence, why TrueNAS prevents you from moving the .system dataset to a pool in which the top-level root dataset is encrypted with a passphrase.

Why did they remove the option to "Lock" a dataset that doesn't use a passphrase? I think it's an artifact of how it was designed with handling GELI (legacy encryption) from version 11.x and earlier. There's no logical reason for preventing a user from locking an encrypted dataset that uses a keyfile instead of a passphrase, aside from the exception explained above in regards to protecting .system.

In the above screenshot, there are no child datasets nested underneath "playground". The dataset is encrypted, using a keyfile.

 

[HarambeLives]

I came across this thread from a Google Search, and also found no way to lock the dataset.

This becomes a much bigger problem when you take into replication. The replication task attempts to match the GID's, not the usernames. So a replicated dataset gets a random mix of users from the second NAS unless all GID's match (And what are the chances of that?)

Now I have an unlocked dataset that can't be locked, which has a random mix of user permissions, and it can't be edited as its read only!

 

[sretalla]

I came across this thread from a Google Search, and also found no way to lock the dataset.

Export the pool and import it again, the datasets will be locked until unlocked again.

Perhaps consider using passphrases on datasets you want to lock/unlock on demand and never encrypt/lock the root dataset (also, don't put any content you want protected in it).

Don't forget what you're protecting against here... Protecting with keys makes sure the disks can't be used in any other system if removed, but doesn't prevent content from being accessed locally, nor in replicated copies where the keys are supplied on the replica server.

Passphrase locked datasets are protected against use even in the local system until somebody unlocks them with the passphrase (at which point the content is open to all with access to the server, including replication... but replication is at block level, so the encryption method will ensure that the passphrase is required on the replica also)

GELI/Legacy encryption is different and I'm not talking about that here, only Native ZFS encryption.

 

[HarambeLives]

I've moved the system dataset off the pool

Is it okay to go and change the encryption to passphrase now, or should I re-create the pool?

 

[HarambeLives]

Answered my own question, yes you can just change it. Works great