3 ms·
I was really surprised when I found out how late-added and immature encryption in ZFS is. I had presumed it would have been table stakes for "enterprise" deploy
by didntcheck 3y ago
I was really surprised when I found out how late-added and immature encryption in ZFS is. I had presumed it would have been table stakes for "enterprise" deployments. Were people just using it on top of block encryption like GELI or LUKS or was I just wrong to assume that most servers are encrypted?
- nubinetwork 3y agoI want to say yes, but putting zfs on luks could leave you with issues where you couldn't import the pool, I wouldn't recommend it personally. I believe FreeBSD didn't have any qualms with putting zfs on geli, but I'm not the best person to ask about that. In what little I've used FreeBSD, I never bothered with geli.
- wkat4242 3y agoI use it on top of geli and it works great. <3 on my daily driver which I sometimes hard reset too. Not sure what the issues are with luks, as I'm mainly on FreeBSD.
- nubinetwork 3y agoA lot of it boils down to "zfs thinks the data is on disk, but is still being passed through the encryption layer, then something bad happened like a power outage or corruption at the encryption layer"
- rincebrain 3y agoAt least the ones I'm familiar with boil down to "there is a logic bug in the encryption layer where some settings get munged" or "there is a memory correctness bug in some edge cases with the weird double-existence that was plumbed in for having encrypted and unencrypted buffers violating expectations in places".