Hello, I have some questions regarding encryption and I hope to find the right answer here, I am reading the tutorial and looking for youtube videos for truenas scale. Wenn I encrypt the whole pool with keys, what am I protecting in detail? The encryption-sign is never locked and I didn’t see an…

I feel that the question you are asking is what risks will encryption protect against. I have good general encryption knowledge but only theoretical TN Scale encryption knowledge, so these are my personal guesses about this… Key File Encryption As I understand it, with Key File Encryption, a data…

And good for end of life disposal too. Often you can’t wipe a failed disk.

Thanks you for the numerous feedback

[image] Stux: And good for end of life disposal too. Often you can’t wipe a failed disk. End-of-life disposal of a failed disk is easy - hit it repeatedly with a sledge-hammer until it is fairly flat or heavily dented. Almost no possibility of recovering the data from dented or shattered pla…

[image] Protopia: If your pool drives are stolen along with the drives holding the encryption key, then simply booting the system will give access to the data. So, explain this statement to me. You come into my house and steal my machine. So, drives and all. You take it home, boot, and, you a…

Just off the top of my head (and I am not a professional white-hat security tester, so this is just based on what I have read)… Using a network share Mount the boot drive on another system (it is unencrypted), grab a copy of the password file and crack it. Perhaps grab the security key file off th…

[image] Protopia: Using a network share Mount the boot drive on another system (it is unencrypted), grab a copy of the password file and crack it. Perhaps grab the security key file off the boot drive. And the password for my network share(s) is…? Grabbing the security key off the boot driv…

[image] sfatula: Yes, my drives are unlocked, but how do you access the data? Don’t even need to boot into TrueNAS. You can boot into a Linux ISO (Ubuntu, Debian, etc), and grab the files pwenc_secret and freenas-v1.db from the plain, unencrypted boot-pool. Now you have access to the entire…

[image] winnielinnie: Don’t even need to boot into TrueNAS Yes, but that was not the comment I was responding to! Again, I realize you can do that, but a thief? Not worried. The specific comment I replied to was: “simply booting the system will give access to the data” That is not the same…

[image] sfatula: The risk of this is close to zero. It is vastly overstated here. Cost, risk, it’s all a matter of context. Let’s ignore the (TrueNAS) restrictions of using passphrase-protected encryption for your dataset(s). The “inconvenience” of having to manually unlock your dataset aft…

I am not disagreeing that the cost of manual entry is low at all! I was merely responding to the boot comment which was incorrect, that’s it! You have changed the discussion to something else. One has to evaluate their own risks and convenience. For example, you are on a trip and lost power, machine…

Encryption Explanation - Hardening

TrueNAS General

winnielinnie September 24, 2024, 4:33pm 23

Yes.

Topic		Replies	Views
Accidental "Reset configuration to defaults" has locked the zpool TrueNAS General SCALE , Question , ZFS	38	923	April 25, 2024
Steps to upgrade from Unencrypted to Encrypted w/ 2 TrueNAS TrueNAS General Encryption	11	330	May 20, 2025
Encryption key weirdness between host and backup pools. host is different from backup, but host unlocks part of backup data TrueNAS General	8	291	May 11, 2024
TPM encryption of dataset encryption keys Feature Requests	12	353	August 30, 2025
ZFS dataset encryption keys or passphrase? TrueNAS General	8	1715	July 12, 2024

Encryption Explanation - Hardening

Related topics