Truenas ZFS encryption solution with offsite keys
reddit / selfhosted

----------------------------------------------------------------------
Icy-Ingenuity335 · 2023-11-07 19:32

For those homelabbers that use Truenas to store your sensitive data.
Here is a solution to have the zfs datasets encrypted without the keys
being stored by Truenas.

I personally have my zfs dataset keys stored in another country on a
VM running this docker image, then when my local Truenas server boots,
the remote VM unlocks the datasets via the Truenas API.

Solution is inspired by a modern KMS architecture where keys are
always kept in a secure location and agents are given them only when
required.

[https://github.com/ThorpeJosh/truenas-zfs-
unlock](https://github.com/ThorpeJosh/truenas-zfs-unlock)

----------------------------------------------------------------------
Diligent_Ad_9060 · 2023-11-07 21:09

Naive question, but what does the security rely on in this scenario?
That you're able to boot truenas?

----------------------------------------------------------------------
No_Dragonfruit_5882 · 2023-11-07 21:51

I dont think its a good idea to send the Keys via an api. But you do
you.

I know its ssl encrypted but still meh.

A full offline Nas in a room with a door, is mostlikly the best way to
do it.

What happens if you Nas is online and someone hacks your vserver?

They now have full controll for your Truenas api.

Maybe its helpful for some of you guys


Thanks for the effort

----------------------------------------------------------------------
mamelukturbo · 2023-11-08 13:01

I like the idea, but do not understand it's usefulness.

Imagine a scenario where FBI is busting down my door to seize my
illegally obtained copy of Barbie movie that is on my NAS. As I hear
the agents breaking down the door I hastily yank the power cable from
the nas.

The agents cuff me, replug the NAS, the remote VM sends the keys via
api, and they all sit down and watch the Barbie movie while I stand
there, cuffed, thinking about how was this supposed to protect me.

What I'm trying to say - how is this functionally really different
from how I have it now where nas unlocks the pools itself on boot.

For posterity sake I am not trying to be fallacious, just stoned and
curious.