freebsd encrypted hard disk?

[Steve Bertrand]

Johann Hasselbach wrote:
> I read the "encrypting disk partitions" section of the Handbook. What
> is the preferred method nowdays, geli or gbde?
> 
> Is there another method that would be better?

I don't know what is best, but for quite some time I've used GELI to
encrypt my entire hard disk, including the / partition.

I then copy /boot to a USB thumb drive with the encryption key so I
don't need any portion of the hard disk unencrypted. This setup also
allows me to pull the USB key from the machine after it has been booted,
taking the encryption key with me.

I've never had a problem.

pearl# df -h
Filesystem       Size    Used   Avail Capacity  Mounted on
/dev/ar0.elia    504M    377M     87M    81%    /
devfs            1.0K    1.0K      0B   100%    /dev
/dev/ar0.elie     47G    9.6G     34G    22%    /usr
/dev/ar0.elif     47G    7.2G     36G    17%    /var
/dev/ar0.elig     47G     25G     19G    57%    /home

Steve