Is my pool GELI encrypted?

Integer · October 25, 2024, 4:06pm

I have a TrueNAS CORE system that I’ve been running for a couple of years. I’m looking to migrate over to SCALE, but that means I need to be very sure I do not have GELI encryption enabled. It has two pools, one small ssd-based pool for the system dataset and one large storage RAIDZ1 pool of with 5 drives.

The storage pool is the one I’m not sure about. My previous FreeNAS system used GELI and I thought I had not done so again because it ended up being a pain to manage. However when I look at the UI Pools page it shows:
“storage (Legacy Encryption)”
which I thought means that the pool is GELI encrypted and currently unlocked for use.

In contrast zpool status shows names that do not include “eli”

zpool status storage
  pool: storage
 state: ONLINE
  scan: scrub in progress since Fri Oct 25 08:08:15 2024
        5.47T scanned at 1.94G/s, 2.95T issued at 1.05G/s, 22.1T total
        0B repaired, 13.35% done, 05:12:06 to go
config:
        NAME                                            STATE     READ WRITE CKSUM
        storage                                         ONLINE       0     0 0
          raidz1-0                                      ONLINE       0     0 0
            gptid/de810821-88c4-11ed-8d09-a8a159461b59  ONLINE       0     0 0
            gptid/de7d7e89-88c4-11ed-8d09-a8a159461b59  ONLINE       0     0 0
            gptid/de77f44f-88c4-11ed-8d09-a8a159461b59  ONLINE       0     0 0
            gptid/de7f9c64-88c4-11ed-8d09-a8a159461b59  ONLINE       0     0 0
            gptid/de7eb210-88c4-11ed-8d09-a8a159461b59  ONLINE       0     0 0

errors: No known data errors

I also tried running this to see if there are any ecrypted disks, though I’m not certain this is a correct way to check:

/usr/local/bin/sqlite3 /data/freenas-v1.db "select count(*) from storage_encrypteddisk;"
0

winnielinnie · October 25, 2024, 4:18pm

GELI encryption.

~~Those are GPTID. Like a serial number, there won’t be a file extension at the end.~~

EDIT: Never mind. I was wrong. You would still see .eli at the end of the GPTID for GELI devices in a zpool status listing.

Integer · October 25, 2024, 4:37pm

Those are GPTID. Like a serial number, there won’t be a file extension at the end.

Darn, so that’s not providing information one way or another.

Sorry, I’m not sure what you mean here.

I found one other thing to check:

zfs get encryption storage
NAME     PROPERTY    VALUE        SOURCE
storage  encryption  off          default

Integer · October 25, 2024, 5:01pm

I’m not sure whether this is useful information:

geli status
            Name  Status  Components
mirror/swap0.eli  ACTIVE  mirror/swap0
mirror/swap1.eli  ACTIVE  mirror/swap1

geli list
Geom name: mirror/swap0.eli
EncryptionAlgorithm: AES-XTS
KeyLength: 128
Crypto: accelerated software
Version: 7
Flags: ONETIME, AUTORESIZE
KeysAllocated: 4
KeysTotal: 4
Providers:
1. Name: mirror/swap0.eli
   Mediasize: 2147483648 (2.0G)
   Sectorsize: 512
   Mode: r1w1e0
Consumers:
1. Name: mirror/swap0
   Mediasize: 2147483648 (2.0G)
   Sectorsize: 512
   Stripesize: 4096
   Stripeoffset: 0
   Mode: r1w1e1

Geom name: mirror/swap1.eli
State: ACTIVE
EncryptionAlgorithm: AES-XTS
KeyLength: 128
Crypto: accelerated software
Version: 7
Flags: ONETIME, AUTORESIZE
KeysAllocated: 4
KeysTotal: 4
Providers:
1. Name: mirror/swap1.eli
   Mediasize: 2147483648 (2.0G)
   Sectorsize: 512
   Mode: r1w1e0
Consumers:
1. Name: mirror/swap1
   Mediasize: 2147483648 (2.0G)
   Sectorsize: 512
   Stripesize: 4096
   Stripeoffset: 0
   Mode: r1w1e1

winnielinnie · October 25, 2024, 5:55pm

That’s referring to ZFS encryption. Nothing to do with GELI.

You’re using GELI encryption.

winnielinnie · October 25, 2024, 6:14pm

That’s the full output?

Then why would the storage dashboard claim you’re using “Legacy Encryption”?

I corrected my above mistake.

Now I’m even more confused. The GUI’s Storage Dashboard is telling you one thing, but zpool and geli commands are telling you another.

Integer · October 25, 2024, 6:24pm

That was the full output for each of zpool status storage, zfs get encryption storage, geli list, and geli status, if that’s what you are asking. I wish I knew why it was saying Legacy Encryption in the dashboard. That’s what has me nervous. I don’t want to risk losing the pool in a SCALE migration. It also shows an unlocked padlock icon between the “storage” and the “(Legacy Encryption)” text.

winnielinnie · October 25, 2024, 6:27pm

Me too. That’s what makes this disconcerting.

To put it another way: If there was no GUI, it would appear to be a zpool with no GELI encryption involved. (Aside from GELI used for the swap partitions.)

I would ask someone from iXsystems. Something is not making sense here…

If there’s no GELI involved, than SCALE (or any Linux distro with modern ZFS) should be able to import the pool.

SeaFox · October 25, 2024, 8:12pm

If you click the gear icon for the pool back on the UI in the Storage section (Pool Operations), do you see a list of Encryption Actions on the menu, like this?

These options are present on a GELI encryption pool, but not the ZFS encryption.

Integer · October 25, 2024, 8:28pm

Yes, I do see an “Encryption Actions” section in the gear menu. It includes:
Encryption Key
Download Key
Manage Recovery Key
Reset Keys

But it doesn’t have “Lock” or “Encryption Key/Passphrase”.

Integer · October 25, 2024, 8:43pm

I opened a bug in Jira since it’s puzzling there is a difference between the output from the CLI and WebUI. Jira

Integer · October 28, 2024, 4:13pm

If I put a SCALE image onto a usb stick, boot from there, and try to import the pool, would that be a good test to see if its really GELI encrypted? Any danger of messing up the pool itself in a way that prevents me from rebooting to the real drives to be back where I am now?

Integer · October 30, 2024, 2:40pm

Well opening the bug was useless. Despite the inconsistency it was closed because “the UI provides the information the user is requesting” without any information about which of the two things it is telling me to believe or why. They also added that I needed to have removed GELI encryption prior to upgrading to 13.0, which disagrees with the documentation.

winnielinnie · October 30, 2024, 2:44pm

The pool will not even be available to import, since the underlying ZFS members will remain hidden behind GELI’s encryption.

Integer · October 30, 2024, 2:48pm

That’s true only if the pool is in fact GELI encrypted, right? And that would not be destructive to the pool. On the other hand if the pool is not GELI encrypted it would be able to import. That would tell me whether it is or is not GELI encrypted. But what I’m not sure of is whether importing the pool into the SCALE system crosses any one way doors. Does that change anything about the pool itself that would p0revent me from shutting down the system, unplugging the USB drive, and booting back up on the existing CORE system and using the pool from there?

winnielinnie · October 30, 2024, 3:06pm

Correct. If it shows a pool available to import (undegraded), then it means there is no GELI being used.

As long as you don’t “upgrade” the pool, then you can always import it with an older version of ZFS / TrueNAS.

I’m not sure how well the config file behaves when going back and forth between Core and SCALE.

Make sure you create a “checkpoint” on your pool first. (You can discard it later.)

Make sure you have an up-to-date config file exported and saved somewhere safe.

Integer · October 30, 2024, 3:33pm

You mean the config of the TrueNAS system? I suspect it does quite badly. The migration documentation says upgrading to SCALE is one way only. Preparing to Migrate | TrueNAS Documentation Hub. Ultimately I want to make that migration, however what I was talking about as a pre-check on the GELI issue was a new, fresh install of SCALE from the iso onto a new usb thumb drive. Boot that and try to import the pool. Leave the existing system pool and config alone. If that works then great, no GELI is being used. Shutdown the server, remove the usb drives, boot back into CORE then continue going through the migration checklist - eventually updating via the UI system->update.

winnielinnie · October 30, 2024, 3:46pm

You don’t even need to try to import the pool.

If it shows up as an “available” pool to import, then it means there is no GELI involved.

No need to proceed to the next steps (of actually importing the pool.)

To verify, you can even type zpool import in the command-line (without any arguments) to see a list of pools available to import.

I find it concerning that the GUI claims you’re using “Legacy Encryption”, yet there are no other indications of such.

Integer · October 30, 2024, 3:52pm

Thanks for the detailed steps. Sounds like I have a weekend project.

I agree that it is concerning that the GUI and nothing else indicated legacy encryption. I wish I knew how it was coming to that determination. The worry in the back of my mind is there’s some entry in a db or config somewhere that incorrectly says it’s encrypted. I’ll find the pool “available” via the test above, but when I actually try to migrate the live system SCALE will see whatever weird config stuck around and refuse to import.

winnielinnie · October 30, 2024, 3:56pm

Using TrueNAS Core 13.0 and 13.3, I can confirm that it still supports importing a pool with underlying GELI devices.

Here is a screenshot from Core 13.3:

Not sure why your bug ticket was closed.