From nobody Tue Feb 01 20:04:48 2022 X-Original-To: freebsd-amd64@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id BA32A198D3FE for ; Tue, 1 Feb 2022 20:04:57 +0000 (UTC) (envelope-from gljennjohn@gmail.com) Received: from mail-ed1-x52c.google.com (mail-ed1-x52c.google.com [IPv6:2a00:1450:4864:20::52c]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1D4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4JpGB05XH6z3NMM for ; Tue, 1 Feb 2022 20:04:56 +0000 (UTC) (envelope-from gljennjohn@gmail.com) Received: by mail-ed1-x52c.google.com with SMTP id l5so36623048edv.3 for ; Tue, 01 Feb 2022 12:04:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=date:from:to:cc:subject:message-id:in-reply-to:references:reply-to :mime-version:content-transfer-encoding; bh=2gXejg0kgQGAlp/aK2wDSy9KYQnkl88ySta8fe6PshU=; b=TiAK+ZyJlshnmJVd3FEZs5rF9Yr3oKgrc1ObsIQxiTh2j/8lvecezaMdo50PilCSQG EoGOnVDu8+9GfkcsgklrLrhLLQyQ/cGvEhIC0Fb3gHm58beNfQIywsS96R7zAkZKRAgM 8XJHxk/D9AgypuGpOa4DsRgsSHhm8REay6QTVoupeRXA9gacT/m/igdKyS1voV0n8Uua 9i1WZpHMAewC6WDl6TlMTUd9N3Ij8hOlU9TYyVohWjehNn3rkcdSRZTwUxROWp/dbVhs 09YRmydd7ncs2FUKEYMWfZXYYRUhYUqlDno5Gf86nK7z+48sypoiro5Cn4icgfSPBBb/ akHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:in-reply-to :references:reply-to:mime-version:content-transfer-encoding; bh=2gXejg0kgQGAlp/aK2wDSy9KYQnkl88ySta8fe6PshU=; b=iWLvf5UoJrUX+Gd8iUY4PktqW1EA4mJdAnqvhBVOEDtl9H5yUXwpixcAyP1t59xQ6A 4BdCNroWdn9v9B0kKGlbv1rji2YUDiQIL6gg4cZuh+zrQ9yFFnqlZiOE/y7aFu7Aqeqf k0qGnyBcCHB9dlhKEt/wXFg6eUI2rYB1MaN4quubOyv6weTSEzuJ88waPQsbwJzdOLyX fxkLwMZXhW1Y5yffQH3cItubLV4sOXLdyENjX6Hy/SaAk/eqwRl0aLFzggQ2v3eRsKpD fU139gJuK4kkfz/EgVSQQZUJ9tTrIGLUfkvZ7IuOHykfZXn1P05rYPHYGR2lLA01Rshp hBlg== X-Gm-Message-State: AOAM532XBO1bP86TAde0lAqs/OI5GFPdlU7a+U1BCNDpyDa4B3LtiQAy wqkh3vqTdZqcrVge5TicGiGDvE0ityo= X-Google-Smtp-Source: ABdhPJytqPEQCdakdBjMocgCbeNStIDkWD3yWzj6vvTiVtWklP86BaCb5j3PgrlrqmwpaBIWq0X0zQ== X-Received: by 2002:a05:6402:1c8a:: with SMTP id cy10mr27418838edb.45.1643745889198; Tue, 01 Feb 2022 12:04:49 -0800 (PST) Received: from ernst.home (p5b3be0d9.dip0.t-ipconnect.de. [91.59.224.217]) by smtp.gmail.com with ESMTPSA id gg14sm15015210ejb.62.2022.02.01.12.04.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 01 Feb 2022 12:04:48 -0800 (PST) Date: Tue, 1 Feb 2022 21:04:48 +0100 From: Gary Jennejohn To: Georg Bege Cc: freebsd-amd64@FreeBSD.org Subject: Re: geli keyfile arguments / gpt partitions Message-ID: <20220201210448.72565274@ernst.home> In-Reply-To: <54f1aaaa-d4ed-1273-df9d-27cae3c1dc5f@bege.email> References: <54f1aaaa-d4ed-1273-df9d-27cae3c1dc5f@bege.email> Reply-To: gljennjohn@gmail.com X-Mailer: Claws Mail 3.18.0 (GTK+ 2.24.33; amd64-portbld-freebsd14.0) List-Id: Porting FreeBSD to the AMD64 platform List-Archive: https://lists.freebsd.org/archives/freebsd-amd64 List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-amd64@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: 4JpGB05XH6z3NMM X-Spamd-Bar: --- Authentication-Results: mx1.freebsd.org; dkim=pass header.d=gmail.com header.s=20210112 header.b=TiAK+ZyJ; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (mx1.freebsd.org: domain of gljennjohn@gmail.com designates 2a00:1450:4864:20::52c as permitted sender) smtp.mailfrom=gljennjohn@gmail.com X-Spamd-Result: default: False [-4.00 / 15.00]; HAS_REPLYTO(0.00)[gljennjohn@gmail.com]; RCVD_VIA_SMTP_AUTH(0.00)[]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+ip6:2a00:1450:4000::/36:c]; FREEMAIL_FROM(0.00)[gmail.com]; REPLYTO_ADDR_EQ_FROM(0.00)[]; RCVD_COUNT_THREE(0.00)[3]; DKIM_TRACE(0.00)[gmail.com:+]; RCPT_COUNT_TWO(0.00)[2]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; NEURAL_HAM_SHORT(-1.00)[-1.000]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; FREEMAIL_ENVFROM(0.00)[gmail.com]; ASN(0.00)[asn:15169, ipnet:2a00:1450::/32, country:US]; DWL_DNSWL_NONE(0.00)[gmail.com:dkim]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; R_DKIM_ALLOW(-0.20)[gmail.com:s=20210112]; RECEIVED_SPAMHAUS_PBL(0.00)[91.59.224.217:received]; FROM_HAS_DN(0.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000]; MIME_GOOD(-0.10)[text/plain]; FREEMAIL_REPLYTO(0.00)[gmail.com]; PREVIOUSLY_DELIVERED(0.00)[freebsd-amd64@freebsd.org]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RCVD_IN_DNSWL_NONE(0.00)[2a00:1450:4864:20::52c:from]; MLMMJ_DEST(0.00)[freebsd-amd64]; RCVD_TLS_ALL(0.00)[] X-ThisMailContainsUnwantedMimeParts: N On Tue, 1 Feb 2022 20:06:06 +0100 Georg Bege wrote: > Hello mailing list, > > Im trying to realize a specific encrypted setup on my FreeBSD machine at home. > > For now I've a raidz2 pool, which did contain root - however it doesnt boot anylonger. > > I have a dedicated SATA disk with UEFI boot code and /boot data, so this works and I can bootup. > > What I wanted to do now is now encrypt the devices of the pool, > > which should work in general because I can boot the kernel and thus the kernel should be able to decrypt the required disk devices. > > > My issue is now that if I find anything on google etc, all examples want me to put the keyfile on /boot and then provide it as an argument like: > geli__keyfile0_name="/boot/encrypted.key" > > This is something I dont want to do, instead I'd prefer that I put the keyfile data on a single gpt partition of an usb stick of my choice - > > I can reach this device whenever I boot up... however it seems I can not provide a /dev/... device just like this as an argument. > > I dont even know if the kernel is able to read raw data from a gpt partition... but well why not? It should be possible? > > > Has anyone a clue how to archive this or which arguments I need to provide? > I have a geli-encrypted SSD in a USB3 enclosure and the key and passphrase are both on a USB stick. I use bash, so I wrote a bash-function which mounts the stick and then cats the passphrase from the stick, which I then copy and paste using the mouse. In my case the SSD s always /dev/daX and the stick is always /dev/daY, which simplifies the function. The stick is mounted as /key. So, basically the function does this: 1) check whether the user is root and bail out if that is not the case 2) mount /dev/daY /key 3) cat the passphrase from /key and copy/paste with the mouse 4) geli attach -k /key/your.key /dev/daX (geli prompts for the passphrase here) 5) mount /dev/daX.eli /your_mount_point 6) umount /key 7) clear Once the SSD is mounted the screen is cleared and I can remove the stick. Shouldn't be difficult to do this for a fixed disk. -- Gary Jennejohn