From owner-freebsd-fs@freebsd.org Tue Jul 14 18:14:07 2020 Return-Path: Delivered-To: freebsd-fs@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id C206136B364 for ; Tue, 14 Jul 2020 18:14:07 +0000 (UTC) (envelope-from ck-lists@cksoft.de) Received: from mx1.cksoft.de (mx1.cksoft.de [IPv6:2001:67c:24f8:1::25:1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mx1.cksoft.de", Issuer "CA" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4B5pYq1WsLz4KD1; Tue, 14 Jul 2020 18:14:06 +0000 (UTC) (envelope-from ck-lists@cksoft.de) Received: from m.cksoft.de (m.cksoft.de [IPv6:2001:67c:24f8:2003::25:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.cksoft.de (Postfix) with ESMTPSA id 7A4C71E9EB6; Tue, 14 Jul 2020 20:13:58 +0200 (CEST) Received: from amavisfra1.cksoft.de (unknown [IPv6:2001:67c:24f8:2003::25:a1]) by m.cksoft.de (Postfix) with ESMTP id 2AD1C63027; Tue, 14 Jul 2020 20:13:58 +0200 (CEST) X-Virus-Scanned: amavisd-new at cksoft.de Received: from m.cksoft.de ([IPv6:2001:67c:24f8:2003::25:3]) by amavisfra1.cksoft.de (amavisfra1.cksoft.de [IPv6:2001:67c:24f8:2003::25:a1]) (amavisd-new, port 10051) with ESMTP id eQ8LuSygdGiT; Tue, 14 Jul 2020 20:13:52 +0200 (CEST) Received: from nocfra1.cksoft.de (nocfra1.cksoft.de [IPv6:2001:67c:24f8:2001::53:1]) by m.cksoft.de (Postfix) with ESMTP id 5348C63026; Tue, 14 Jul 2020 20:13:54 +0200 (CEST) Received: by nocfra1.cksoft.de (Postfix, from userid 1000) id 6303813ECA; Tue, 14 Jul 2020 20:13:54 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by nocfra1.cksoft.de (Postfix) with ESMTP id 5E58B13E4A; Tue, 14 Jul 2020 20:13:54 +0200 (CEST) Date: Tue, 14 Jul 2020 20:13:54 +0200 (CEST) From: Christian Kratzer X-X-Sender: ck@nocfra1.cksoft.de Reply-To: Christian Kratzer To: Allan Jude cc: freebsd-fs@freebsd.org Subject: Re: gptzfsboot targeting wrong vdev In-Reply-To: Message-ID: References: <9400f5f0-e267-932c-b1ce-8436748cf2c0@FreeBSD.org> <78024f0d-4889-713e-15a5-56ec6d8d82b3@freebsd.org> User-Agent: Alpine 2.22 (BSF 395 2020-01-19) X-NCC-RegID: de.cksoft X-Spammer-Kill-Ratio: 75% MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed X-Rspamd-Queue-Id: 4B5pYq1WsLz4KD1 X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org; none X-Spamd-Result: default: False [-4.00 / 15.00]; ASN(0.00)[asn:57407, ipnet:2001:67c:24f8::/48, country:DE]; REPLY(-4.00)[] X-BeenThere: freebsd-fs@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: Filesystems List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2020 18:14:07 -0000 Hi, On Mon, 13 Jul 2020, Allan Jude wrote: > So are your SLOG devices not encrypted? That seems like an oversight, > since any synchronous writes will be written to the SLOG first. yes the slog devices are not encrypted. And /boot/keys contains the keys. All of the above are on the ada0, ada1 m2 ssd devices. The main threat scenario I am protecting against is disposal of end of live or broken disks in the main pool. If I wanted to protect ada0/1 I would need to fall back to booting from a separate external devices again that also includes the keys. Greetings Christian -- Christian Kratzer CK Software GmbH Email: ck@cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Mobile: +49 171 1947 843 Geschaeftsfuehrer: Christian Kratzer Web: http://www.cksoft.de/