From owner-freebsd-fs@FreeBSD.ORG Tue Sep 7 10:10:55 2010 Return-Path: Delivered-To: freebsd-fs@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 3FB0010656B5; Tue, 7 Sep 2010 10:10:55 +0000 (UTC) (envelope-from k0802647@telus.net) Received: from outbound03.telus.net (outbound03.telus.net [199.185.220.222]) by mx1.freebsd.org (Postfix) with ESMTP id E51F98FC1A; Tue, 7 Sep 2010 10:10:54 +0000 (UTC) Received: from edtnaa01.telusplanet.net ([66.183.53.162]) by priv-edtnes29.telusplanet.net (InterMail vM.7.09.01.00 201-2219-108-20080618) with ESMTP id <20100907101054.UGUP11932.priv-edtnes29.telusplanet.net@edtnaa01.telusplanet.net>; Tue, 7 Sep 2010 04:10:54 -0600 Received: from oliver.bc.lan (d66-183-53-162.bchsia.telus.net [66.183.53.162]) by edtnaa01.telusplanet.net (BorderWare Security Platform) with ESMTP id 18C083C1EBA851DA; Tue, 7 Sep 2010 04:10:53 -0600 (MDT) Received: from [10.111.111.112] (unknown [10.111.111.112]) by oliver.bc.lan (Postfix) with ESMTP id 5E3B862A4; Tue, 7 Sep 2010 03:10:53 -0700 (PDT) Message-ID: <4C860FAC.5070700@telus.net> Date: Tue, 07 Sep 2010 03:10:52 -0700 From: Carl User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.7) Gecko/20100713 Lightning/1.0b2 Thunderbird/3.1.1 MIME-Version: 1.0 To: Pawel Jakub Dawidek , freebsd-fs@freebsd.org References: <4C834D1A.2010405@telus.net> <20100905150344.GD1900@garage.freebsd.pl> In-Reply-To: <20100905150344.GD1900@garage.freebsd.pl> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Cloudmark-Analysis: v=1.1 cv=+EoSOrAnwUvjIXL1uzjT8lcUSwg7SnZy9aakk+NQyVs= c=1 sm=0 a=pl1w12ep0ysA:10 a=8nJEP1OIZ-IA:10 a=HNgjH8kF64GtJ7EcXKEMsQ==:17 a=mnuoJeblHigEZOc-yEoA:9 a=B87ekR2KspwKf56rLXRvfhBGXK8A:4 a=wPNLvfGTeEIA:10 a=HpAAvcLHHh0Zw7uRqdWCyQ==:117 Cc: Subject: Re: geli'd swap and core dumps X-BeenThere: freebsd-fs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Filesystems List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Sep 2010 10:10:55 -0000 On 2010-09-05 8:03 AM, Pawel Jakub Dawidek wrote: >> What are best practices for achieving encrypted swap and functional core >> dump recovery? Or are these mutually exclusive goals? > > Well, the idea to encrypt swap is to prevent any sensitive data to be > stored on disk unencrypted where it might last for a long time. > If you configure to dump kernel memory to a disk (kernel dumps are not > encrypted) you kinda miss the point, as kernel memory can contain a lot > of sensitive data. It makes sense that best practice would be to disable the dump device, yet it appears dumpdev is set to AUTO as the default on current versions of FreeBSD. Does AUTO imply a behaviour that will intelligently recognize the lack of a functional dumpdev in the case of a geli'd swap or do I need to explicitly set dumpdev to NO to avoid errors on normal startups or even bad behaviour during a kernel panic? Carl / K0802647