gbde and geli - differences

Roland Smith rsmith at
Tue Mar 20 23:15:06 UTC 2007

On Tue, Mar 20, 2007 at 10:36:19PM +0000, RW wrote:
> On Tue, 20 Mar 2007 19:06:28 +0100 (CET)
> Wojciech Puchar <wojtek at> wrote:
> > what they are. both works, both works right.
> > geli has more options.
> > 
> > why there are both? what should i use to have better chance i will be
> > able to recover data after say 10 years knowing password?
> I presume it's to do with geli using OpenSSL libraries and so picking-up
> hardware acceleration where available. I think gdbe is being sidelined.

geli uses the crypto(9) framework. Not sure about the OpenSSL libraries.

> > i need both encrypted partition and encrypted copies/DVDs.
> I'd be interested if anyone has a method for creating encrypted DVDs
> that still works. 

You can use a UFS filesystem on a DVD. In short:
- create an file with random characters the size of a DVD.
- use that as a vnode backed memory disk with mdconfig.
- initialize and attach that with geli.
- create a new filesystem on the geli device
- mount it.


# dd if=/dev/random of=$HOME/backupDVD.img bs=1m count=4000
# mdconfig -a -t vnode -f $HOME/backupDVD.img
(The name of the md device will be printed on stdout, e.g. 'md0'.)
# geli init -l 256 /dev/md0
# geli attach /dev/md0
# newfs /dev/md0.eli
# mount /dev/md0.eli /mnt/root

Use it. Then:

# umount /mnt/root
# geli detach md0.eli
# mdconfig -d -u 0

[plain text _non-HTML_ PGP/GnuPG encrypted/signed email much appreciated]
pgp: 1A2B 477F 9970 BA3C 2914  B7CE 1277 EFB0 C321 A725 (KeyID: C321A725)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url :

More information about the freebsd-questions mailing list