Questions on GELI encryption

[Ivan Voras]

Dan Naumov wrote:
> Hello (World) again :)
> 
> Sorry for creating another discussion thread so fast, but I figured
> that since the new questions I have do not fall under the scope of
> "CPU horsepower requirements for GELI", I thought they deserved a new
> one:
> 
> 1) I am reading the Handbook section on GELI (
> http://www.freebsd.org/doc/en/books/handbook/disks-encrypting.html )
> and I am a bit confused. The example
> 
>   a) creates a keyfile
>   b) initializes a provider with the keyfile
>   c) attaches the provider
>   d) creates a new filesystem directly on the provider and
>   e) mounts it
> 
> Now, I am probably missing something very obvious, but are "slices" no
> longer a requirement for creating and using an UFS filesystem in
> FreeBSD?

No, and have not been since introduction of GEOM a long-ish time ago.

> 2) The example in the Handbook encrypts the entire drive. If my system
> is going to use 1 big drive, I want /home and /data encrypted, while
> the rest of the system can stay non-encrypted, how should I go about
> doing this? Should I create a single big slice with 1 big root
> partition and 2 separated partitions for /home and /data and the
> initialise GELI on these specific partitions?

Yes.

> Can basically anything
> be used a a "provider" for GELI? A disk drive, a slice, a partition
> inside a slice, a file?

Yes, again because of GEOM, not specific to GELI.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 260 bytes
Desc: OpenPGP digital signature
Url : http://lists.freebsd.org/pipermail/freebsd-geom/attachments/20090527/830d4e7a/signature.pgp