I’ve used TrueNAS at home for a bit now, and generally had a positive experience with it. Commercially we’re starting to look at some aging infrastructure and replacing with more modern focus-built solutions and TrueNAS has come up in conversation.
The issue is, there is a hard CSO/policy requirement for full encryption at rest for all volumes/data, including the system/OS volumes. (TrueNAS’ BOOT volume would qualify.) The exception is for essentially “unmodified” or stock volumes like OS installation media and recovery. This is relatively straightforward for us with Windows and most Linux distros (either LUKS or native ZFS encryption at the root of the pools).
The business concern is that even metadata (eg networking configuration) is considered sensitive and should be protected – never mind if ZFS data partition keys are stored on the BOOT volume.
We’re also looking at TPM2.0 based key storage and evaluating it, but currently only use it for Windows servers (due to the Secure Boot chain implementation). Currently it is preferred to have manual intervention to boot a system (decryption/key entry) vs leaving information unencrypted at rest.
Best I can tell this is not an option in the Community Edition, and may not be in the Enterprise Edition either. (I did some searches, and results generally indicate this is not possible.) Is this something that TrueNAS is looking to support going forward?
Would have to use an SED. Without using an SED, FreeNAS/TrueNAS doesn’t encrypt the boot device. Not with ZFS, LUKS, or GELI.
EDIT: I’m not sure if even the Enterprise edition natively supports SED as a boot option during installation or if you’re meant to configure its encryption outside of TrueNAS.
Thank you. We’ve looked at SEDs in the past and the CSO wasn’t sold on them (due to past firmware vulnerabilities and difficulty in verifying the encryption). They are technically allowed, but requirements are a bit annoying (per drive authentication keys as opposed to per-volume ZFS keys).
It does look like TrueNAS is not suitable for that environment.
This design decision of not using encrypted OS has come up before. Some people insist that iX / TrueNAS must support such. A few go to great lengths to manually support such, like with ZFS on top of LUKS. Perhaps someday encrypted OS will be supported.
In someways the existing native ZFS encryption is not suitable for some applications because the Dataset & Volume names, and some other higher level metadata is not encrypted. (Like the command history…)
To be clear, ZFS on top of virtual devices, (from hypervisors, hardware RAID, or LUKS), is generally not a good idea. This is because most ZFS testers have not bothered with verifying that such supports the proper pass through of write barriers / device cache flushes. And of course, in-order writes. If either of those are not fully supported by the virtual devices below ZFS, then during power loss, data loss of existing data can occur.
Your company should be reaching out to the TrueNAS company. If paying customers are asking for certain items, they will be listened to before the CE forums.
Use the links from their website to contact Sales, etc.
I understand, I was trying to avoid throwing another company name into the hat with the project lead (who is not me) if it’s a non-starter anyway.
I do know we have some ZFS-encrypted systems already that are approved (ZFS native, not LUKS), so while not fully encrypted on the metadata front, it was enough to pass muster, but I know having networking details and whatnot unencrypted was a no-go.
An ugly workaround, virtualize TrueNAS with Windows Hyper-V and BitLocker.
Install Windows, enable TPM and turn on BitLocker for Full Disk Encryption with boot support and auto-unlock.
Install TrueNAS as a Hyper-V VM (Gen2). Store the TrueNAS OS VHDX file on a BitLocker volume. All TrueNAS OS related setting including network config are fully encrypted.
The TrueNAS data disk is a bit tricky. Assume using Hyper-V HDD passthrough, what I can think of is to create a encrypted pool and auto-mount-decrypt it on TrueNAS boot. The decrypt key is stored on TrueNAS boot drive VHDX, so it gets same protection as OS other configurations.
