Native encryption

[mdimura]

Would it be possible to add a decryption support similar to how omv-luks-start works? So that the system does not try to boot, until encrypted zfs datasets are decrypted (e.g. via ssh)?

[subzero79]

omv-luks-start is not part of the official plugin. Is a fork I did and I haven’t push any changes or committed back to the original plugin.

Something similar can be achieved if you want that on zfs but just set it manually. The creation of that fork of the luks plugin is based on this.

https://blog.iwakd.de/headless-luks-decryption-via-ssh

[mdimura]

I managed to achieve desired behavior using a simple systemd service and systemd-ask-password. I am sharing my solution here if someone is looking for one.

/root/zfs-unlock.sh (must be executable):

#!/bin/bash

function wait_unlocked() {
while zfs list -H -o keystatus | grep -q 'unavailable'; do
  sleep 3
done
}

function unlock(){
while zfs list -H -o keystatus | grep -q 'unavailable'; do
  pass=$(systemd-ask-password "Enter ZFS passphrase:" --timeout=0)
  datasets=`zfs list -H -o name,keystatus | grep 'unavailable' | awk '{print $1}'`
  for ds in $datasets; do
    echo -e "$pass" | zfs load-key $ds
  done
done
}

if [ "$1" = "-s" ]; then
  #run as systemd service
  unlock &
  wait_unlocked
else
  unlock
  echo 'Unlocked successfully!'
fi

/etc/systemd/system/zfs-unlock.service:

[Unit]
Description=Unlock encrypted zfs datasets
DefaultDependencies=no
After=zfs-import.target
Before=zfs-mount.service

[Service]
Type=oneshot
TimeoutStartSec=0
ExecStart=/root/zfs-unlock.sh -s
RemainAfterExit=yes

[Install]
WantedBy=zfs-mount.service

Once the service is enabled (systemctl enable zfs-unlock.service), it will request the passphrase during boot via tty (before login) and the user can also provide via ssh by running /root/zfs-unlock.sh. This is an ssh-friendly version of the service from Archlinux wiki and it uses one passphrase for all datasets.

[MrPeteypoo]

This would be a really useful feature to have, without it I'm not sure I can use OMV because I like having my data encrypted by default and having to SSH into my headless server anytime it reboots is a pretty bad UX.

[ka-bo]

Any option one could run something like that from out of the Web-UI?