Syncing & Restoring data > unencrypted ZFS Volume to encrypted ZFS Volume

[Jim H]

Restoring synced data from encrypted volume on a remote freenas host to a non encrypted volume on a different freenas host. Any thoughts on if this will work or not? We are concerned that the data will not be usable if copied back as part of a restoring data.

I have a freenas 9.1 instance with a ZFS volume that hosts ISCSI file extent targets for windows server located in a secure datacenter. the ZFS volume is NOT using encryption. I want to sync this data (over ssh of course) to a remote location where another freenas 9.1 device is similarly configured except that there are no ISCSI targets and the ZFS volume on the freenas host DOES have encryption enabled. The reason for doing this is to satisfy auditor, as the data falls "in scope" for compliance. The data does not have to be encrypted in the production environment as access to the data is well controlled, monitored, and protected with PGP at the individual file level. the backup freenas host is in a less secure location. Even though this host acts only as a backup target for the production host (no storage presentation, user shares, etc) site to site encrypted tunnel allowing access only from production freenas host (no webui / management network) the auditor insists on a form of whole disk encryption capable of protecting system from drive removal

 

[Jim H]

It looks like I need to try BSD forums

 

[solarisguy]

You need snapshots and zfs send/receive.

ZFS encryption is not relevant in the situation you had described, since is scrambles data written to the physical disk, and not data exposed by the dataset (filesystem).

And yes, FreeNAS documentation and the forum do not cover well zfs send/receive combo, since FreeNAS has no interface for that feature = shell programming needs to be used.

 

[Jim H]

I am truly rethinking the use of FreeNas I have tried to follow their documentation on ssh and get nothing but uudecode errors on key read so I cant even get to zfs replication and encryption testing. I guess you get what you pay for, for those who want to spend the time making this FreeNas thing work it can be a great solution. This has taken far too long to get setup, so Windows 2012 server here we come !!