Storage Encryption

Creating a new encrypted pool automatically generates new key file and prompts to download it. Always back up the key file to a safe and secure location.

To manually back up a root dataset keyfile by opening the pool settings menu and selecting Export Dataset Keys.

To change the key, click the dataset more_vert and Encryption Options.

Enter your custom key or click Generate Key.

To use a passphrase instead of a keyfile, click the dataset more_vert and Encryption Options. Change the Encryption Type from Key to Passphrase.

Set the rest of the options:

• Passphrase : User-defined string used to decrypt the dataset. Can be used instead of an encryption key. Must be longer than 8 characters.

  The passphrase is the only means to decrypt the information stored in this dataset. Be sure to create a memorable passphrase or physically secure the passphrase.

• pbkdf2iters : Number of password-based key derivation function 2 (PBKDF2) iterations to use for reducing vulnerability to brute-force attacks. Entering a number larger than 100000 is required.

1. Replicate every encrypted dataset you want to replicate with properties.
2. Export key for every child dataset which has a unique key.
3. For each child dataset construct a proper json with poolname/datasetname of the destination system and key from the source system like this: {"tank/share01": "57112db4be777d93fa7b76138a68b790d46d6858569bf9d13e32eb9fda72146b"}
4. Save this file with the extension .json.
5. On remote system unlock the dataset(s) using properly constructed json files.

Uncheck properties when replicating so that the destination dataset will not be encrypted on the remote side and will not require a key to unlock.

1. Go to Tasks > Replication Tasks and click ADD.
2. Click ADVANCED REPLICATION CREATION.
3. Fill out the form as needed and make sure Include Dataset Properties is NOT checked.
4. Click SUBMIT.

This method does not preserve file ACLs.

The web interface supports using Tasks > Rsync Tasks to transfer files out of the GELI pool. In the Shell, rsync and other file transfer mechanisms (scp, cp, sftp, ftp, rdiff-backup) are available for copying data between pools.

These instructions are an example walkthrough. It is not an exact step-by-step guide for all situations. Research ZFS send/receive before attempting this. There are many edge cases that cannot be covered by a simple example.

Legend:

GELI Pool = pool_a
Origin Dataset = dataset_1
Latest Snapshot of GELI Pool = snapshot_name
ZFS Native Encrypted Pool = pool_b
Receieving Dataset = dataset_2

1. Create a new encrypted pool in Storage > Pools.
2. Open the Shell. Make a new snapshot of the GELI pool and dataset with the data to be migrated: zfs snapshot -r pool_a/dataset_1@snapshot_name.
3. Create a passphrase: echo passphrase > /tmp/pass.
4. Use ZFS send/receive to transfer the data between pools: zfs send -Rv pool_a/dataset_1@snapshot_name | zfs recv -o encryption=on -o keyformat=passphrase -o keylocation=file:///tmp/pass pool_b/dataset_2.
5. When the transfer is complete, go to Storage > Pools and lock the new dataset. After locking the dataset, immediately unlock it. TrueNAS prompts for the passphrase. After entering the passphrase and the pool is unlocked, you can delete the /tmp/pass file used for the transfer.
6. If desired, you can convert the dataset to use a keyfile instead of a passphrase. To use a key file, click the dataset   (Options) and click Encryption Options. Change the Encryption Type from Passphrase to Key and save. Back up your key file immediately!
7. Repeat this process for every dataset in the pool that needs to be migrated.