Date: Wed, 03 Sep 2014 21:44:49 -0500 From: Karl Denninger <karl@denninger.net> To: freebsd-geom@freebsd.org Subject: Re: Attempt to add multiple device attachment to "geli attach" Message-ID: <5407D221.5000609@denninger.net> In-Reply-To: <20140903200014.GB82175@funkthat.com> References: <54076871.5010405@denninger.net> <54076CFE.5010308@denninger.net> <20140903200014.GB82175@funkthat.com>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --]
On 9/3/2014 15:00, John-Mark Gurney wrote:
> Karl Denninger wrote this message on Wed, Sep 03, 2014 at 14:33 -0500:
>> Never mind... I know what I missed -- the key generation that is passed
>> in is dependent on the metadata read from the userspace.
>>
>> More work to do here.... will have to pass a separate key structure for
>> each disk and it will also require some more work in the userspace
>> command area so it doesn't prompt a second time for a password.
>>
>> I'll post the completed patch set once I have it if people here think it
>> would be interesting.
> Just some comments on this as I've thought about this issue...
>
> There are two issues here, one is for root and one is for geli
> volume mounted later...
>
> For the later, I personally use a key volume that is encrypted, and uses
> that "key store" for my large 8 disk raidz pool.. This is less of an
> issue, but still requires me to type in the password twice... It
> basicly boils down to:
> (cd /zkeys && for i in *.key; do geli attach -p -k "$i" "label/${i%.key}"; geli attach -p -k "$i" "gpt/${i%.key}"; done) || exit 5
>
> I have to do both label and gpt since disks are labeled, but things like
> zlog are on gpt partitions...
>
> I haven't reviewed your patch, nor have I looked at how geli keys
> volumes upon init, but make sure that you have each volume's master
> key salted seperately... This way if the volumes get seperated from
> your system, it won't leak that they use the same key... Yes, it'll
> take a bit more cpu time to unlock, but not that big of an issue IMO...
>
> Handling unlocking mirrored roots is a bit more interesting as you
> now have to touch the geli kernel code...
>
> btw, reattaching a single disk that was previously part of a pool is
> fast... I've done this on more than one occasion where one disk drops
> out of the raidz and then shortly after I reattach it... It will
> recognize the original data, so only if new data that got written
> can't be read will you suffer a loss, but that would be a double failure
> case, and known limitation of raidz...
>
> Thanks for looking at this... I'm definately interested in making
> multi disk geli more usable...
>
> $find /dev -name "*.eli" | wc -l
> 17
>
> :)
>
> 8 (raidz data disks) + 2 (mirrored root) + 1 (swap) + 2 (cache) +
> 2 (log) + 2 (duplicates from root ada vs ad)
>
Try this in /usr/local/etc/rc.d -- it is a modification of the geli
script and gets the password, then iterates over the disks and tries to
attach them. If it fails it will prompt you again (up to three times as
does the stock code, but you can override that if you want.) This is to
be used in place of the geli option in /etc/rc.conf.
Place the disks in /etc/rc.conf as:
encrypt_disks="..... "
The usual geli overrides also work (since I cribbed the code), EXCEPT
the detach-on-close -- I have had serious problems with that when a
non-related drive detaches from the bus -- it has on multiple occasions
caused all my geli disks to detach on the same adapter! Needless to say
I don't set that flag any more -- I let the kernel detach them when the
machine shuts down.
As long as the password you originally supply is good it will keep
iterating through the list and mount them all. Voila -- enter it once!
#!/bin/sh
#
# Copyright 2014 Karl Denninger <karl@denninger.net>
# Cribbed modified from original as below
#
# Copyright (c) 2005 Pawel Jakub Dawidek <pjd@FreeBSD.org>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
# SUCH DAMAGE.
#
# $FreeBSD$
#
# PROVIDE: disks
# REQUIRE: initrandom
# KEYWORD: nojail
. /etc/rc.subr
name="encrypt"
start_cmd="encrypt_start"
stop_cmd="encrypt_stop"
required_modules="geom_eli:g_eli"
encrypt_start()
{
devices=${encrypt_disks}
echo -n 'Geli attach Password: '
stty -echo
read password
stty echo
echo
if [ -z "${encrypt_tries}" ]; then
if [ -n "${encrypt_attach_attempts}" ]; then
# Compatibility with rc.d/gbde.
encrypt_tries=${encrypt_attach_attempts}
else
encrypt_tries=`${SYSCTL_N} kern.geom.eli.tries`
fi
fi
for provider in ${devices}; do
provider_=`ltr ${provider} '/-' '_'`
eval "flags=\${encrypt_${provider_}_flags}"
if [ -z "${flags}" ]; then
flags=${encrypt_default_flags}
fi
if [ -e "/dev/${provider}" -a ! -e "/dev/${provider}.eli" ]; then
echo "Geli attach ${provider}."
count=1
while [ ${count} -le ${encrypt_tries} ]; do
echo $password | geli attach -j - ${flags} ${provider}
if [ -e "/dev/${provider}.eli" ]; then
break
fi
echo "Attach failed; attempt ${count} of ${encrypt_tries}."
count=$((count+1))
if [ ${count} -gt ${encrypt_tries} ]; then
echo "KEY MISMATCH ERROR - Abort"
exit 1
fi
echo -n 'Geli attach Password: '
stty -echo
read password
stty echo
echo
done
else
if [ -e "/dev/${provider}" ]; then
echo "${provider} is already attached."
else
echo "${provider} does not exist."
fi
fi
done
}
encrypt_stop()
{
devices=${encrypt_disks}
for provider in ${devices}; do
if [ -e "/dev/${provider}.eli" ]; then
umount "/dev/${provider}.eli" 2>/dev/null
geli detach "${provider}"
fi
done
}
load_rc_config $name
run_rc_command "$1"
--
-- Karl
karl@denninger.net
[-- Attachment #2 --]
0 *H
01 0 + 0 *H
O0K030
*H
01 0 UUS10UFlorida10U Niceville10U
Cuda Systems LLC1 0UCuda Systems LLC CA1/0- *H
customer-service@cudasystems.net0
130824190344Z
180823190344Z0[1 0 UUS10UFlorida10UKarl Denninger1!0 *H
karl@denninger.net0"0
*H
0
bi՞] MNԿawx?`)'ҴcWgR@BlWh+ u}ApdCF JVй~FOL }EW^bچYp3K& ׂ(R
lxڝ.xz?6 &nsJ +1v9 v/( kqĪp[vjcK%fϻe?iq]z
lyzFO'ppdX//Lw(3 JI A*S#՟H[f|CGqJKoo y.oEuOw$ /섀$삻J9b|A P~8]D1YI<"""Y^T2iQ2 b yH)] Ƶ0y$ _N 6XqMC 9 XgώjGTP"#nˋ"Bk1 00 U 0 0 `HB0 U 0, `HB
OpenSSL Generated Certificate0 U |8 ˴d[20 U #0]Af4 U3x&^"408 `HB+)https://cudasystems.net:11443/revoked.crl0
*H
gBwH] j\x`( &gW32"Uf^. ^Iϱ
k!DQA g{(w /)\N'[ oRW @C HO>)XrTNɘ!u`xt5(=f\-l3<@C6mnhv##1ŃbH͍_Nq
aʷ?rk$^9TIa!kh,D -ct1
0001 0 UUS10UFlorida10U Niceville10U
Cuda Systems LLC1 0UCuda Systems LLC CA1/0- *H
customer-service@cudasystems.net0 + ;0 *H
1 *H
0 *H
1
140904024449Z0# *H
1*Ba\
n%0l *H
1_0]0 `He*0 `He0
*H
0*H
0
*H
@0+0
*H
(0 +71001 0 UUS10UFlorida10U Niceville10U
Cuda Systems LLC1 0UCuda Systems LLC CA1/0- *H
customer-service@cudasystems.net0 *H
101 0 UUS10UFlorida10U Niceville10U
Cuda Systems LLC1 0UCuda Systems LLC CA1/0- *H
customer-service@cudasystems.net0
*H
m3T t)@uua\\>IZxObVj$Gd$SMM^+;,9|QʂwAUļ<K3/)ޡ>tVέa/Gd9ln? 3£D<y5[h'Z42Qp <s] ęC:K6{v(,
50=rO sa z /WtkF&O7hxNJ_.?9pzeLi$fxzm eYp1&5eO%B( UiW\GrѡPZ?SٌO6[t,B&Go>
wx"rNSb;tUtRK ` ]'Za-$
dX%X =`U }gIeg1 ?yD3D(n`j2iy:@102
] J]xi
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5407D221.5000609>