3 ms·

Native (per-dataset) encryption. This has been a possibility since ZoL 0.8.0 [0] released two years ago. This means that the stream created by zfs send is seam

by agurk 6y ago

Native (per-dataset) encryption. This has been a possibility since ZoL 0.8.0 [0] released two years ago. This means that the stream created by zfs send is seamlessly encrypted. I waited until this feature was released/stable before I started uploading to AWS. Practically you need to add the -w or --raw flag to zfs send to make it do this. [0] https://github.com/openzfs/zfs/releases/tag/zfs-0.8.0 https://github.com/openzfs/zfs/releases/tag/zfs-0.8.0

nickik 6y ago
But if my dataset is not encrypted already (legacy dataset), it will not be encrypted?
- agurk 6y ago
  That is correct, this script will not add any encryption. It would be trivial to add however by adding gpg into the send command pipeline: /sbin/zfs send --raw -cp $snapshot | pv -s $snapshot_size | aws s3 cp - <args> would become: /sbin/zfs send --raw -cp $snapshot | gpg --encrypt <args> | pv -s $snapshot_size | aws s3 cp - <args>
charcircuit 6y ago
Doesn't that only encrypt the data, leaking stuff like filenames, or has that been mitigated?
- agurk 6y ago
  From the zfs man page: > ZFS will encrypt file and zvol data, file attributes, ACLs, permission bits, directory listings, FUID mappings, and userused / groupused data. I don't believe that the native encryption ever leaked file listings. That could have been something that the older/non-native techniques did.
  - charcircuit 6y ago
    I was probably thinking of file sizes not being encrypted. Thanks for correcting me.