From owner-freebsd-questions@FreeBSD.ORG Sun Aug 31 16:48:58 2014 Return-Path: Delivered-To: questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id A3A01B0A for ; Sun, 31 Aug 2014 16:48:58 +0000 (UTC) Received: from mail-pa0-x22a.google.com (mail-pa0-x22a.google.com [IPv6:2607:f8b0:400e:c03::22a]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 7AA091BDA for ; Sun, 31 Aug 2014 16:48:58 +0000 (UTC) Received: by mail-pa0-f42.google.com with SMTP id lf10so10315567pab.1 for ; Sun, 31 Aug 2014 09:48:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=Bn/hJr4gl8YexTqERCItoZ8kX7UXe+mDA3zndVN8GJ8=; b=iIY+3uScGCBfaTYTN3DuyBfW1UKO9ofIsA5v9cXiwqj3SR0yf72N4gMU2QsFDb9M0X PRBcUa69p79vrF2xvklVWGXDN+TbmxfzPD8SCGiD5Vh0w1XlUPZMgA1PFjz0iQ6gE7wU yzjYQH33/RrWX1WQYX1/eRA/dvjpkMhRM2iEYl0Dj74fOAY0pFrgsUj/enbAoiKuSxh4 03IRnMPZpwe9t+pw40N/j/6/bv1+ixI3POPGAgdgUYCUhoI6sz3nr0giHU5cYnNSwkQa uU5FKz+UYHVsVSLQHF7Z4xH9oavD70iTg1IUrhaHSec8b0pSQafIo2P/eGD9mB5SbI++ ujHQ== MIME-Version: 1.0 X-Received: by 10.70.14.67 with SMTP id n3mr4927826pdc.132.1409503737608; Sun, 31 Aug 2014 09:48:57 -0700 (PDT) Received: by 10.70.118.132 with HTTP; Sun, 31 Aug 2014 09:48:57 -0700 (PDT) In-Reply-To: <201408311611.s7VGBVP9050225@fire.js.berklix.net> References: <540341C8.2040003@tysdomain.com> <201408311611.s7VGBVP9050225@fire.js.berklix.net> Date: Sun, 31 Aug 2014 11:48:57 -0500 Message-ID: Subject: Re: best solution for encrypting a mountpoint? From: Adam Vande More To: "Julian H. Stacey" Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.18-1 Cc: FreeBSD Questions , tyler@tysdomain.com X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 Aug 2014 16:48:58 -0000 On Sun, Aug 31, 2014 at 11:11 AM, Julian H. Stacey wrote: > > FreeBSD supports 2 encrypting file systems, This isn't technically correct on a couple levels. First, gbde and geli encrypt block devices. FS's may live on such a block device and then be encrypted, but then again so could swap. FreeBSD also supports http://wiki.freebsd.org/PEFS through the ports system and this is actually an encrypted filesystem. Additionally I prefer geli over gbde since it supports a wider variety of feature and is perhaps more secure. See the corresponding handbook and man pages for details. -- Adam