OSNews

Hmm - I am using UFS on FreeNAS 8 still... but yeah, I don't remember seeing any encryption settings.

Besides the lack of a torrent client now (which apparently they will add as a plugin soon), my other major annoyance with FreeNAS 8 is that it cannot be installed to the same disk that you use for storage any longer. That was a feature I liked about FreeNAS 0.7 With FreeNAS 8 I have to use a USB stick to boot it, and it's noticeably slower to start up. There are other advantages to using the USB stick, however, so I'm not too upset about it.

I hope that FreeNAS 8 has lots of potential once the new "plugin" features start getting used.

Your beef is really that it is not done yet FreeNAS 8 is a bit like KDE 4. iXsystems is really quite amazing, but they cannot work at warp speed. I bet a pony this new FreeNAS will have the whole kitchen sink this year.

(like KDE 4 in that it shipped missing basic stuff, not that it will take forever to catch up)

I thought the encryption code was already out, but what do I know, not as much as him apparently.

ZFS encryption is a relatively new feature even on Solaris (in fact I wasn't even aware Oracle had released that versions source already).

FreeBSD's current ZFS version (v15?) doesn't even support raidz3 and deduping, which was released quite some time back, so it certainly wouldn't be recent enough to support encryption.

Encrypted volumes protect your data if someone gets physical access to your hardware so I understand why someone would want this on laptops and home computers and things that could be stolen.

What is the benefit of encryption on production NAS systems? Would it just slow things down?

Piece of mind if you get burgled or (if you've got something to hide) raided by the police.

It's a lot easier to decommission an HD if it's encrypted - you just remove the encryption key, and the data is effectively "scrambled".

A good example is a failed HD - depending on how the disk fails, you may not be able to erase it with zeros, but someone with the proper facilities can still recover the data off it.

If the HD is in an external enclosure (like an external eSATA or USB device), having someone walk off with it is always a possibility as well.

Erasing a disk is time consuming - so being able to simply destroy the encryption key is awfully convenient in many situations (as mentioned in the situation of a police raid - one could just yank the bootable USB key from a FreeNAS box and destroy it rendering the HD contents useless).

Edit: per your performance question, I suspect the network latency/bandwidth is a larger impact when using a NAS. With read/write caching (including read-ahead) and enough RAM, you shouldn't notice much performance impact on block-level encryption. A fast CPU should already do the trick.

Edited 2011-06-09 18:55 UTC

There is some performance penalty for encryption, unless you have an Intel CPU that has AES-NI. Most of the laptops have it now, and a good number of the desktop CPUs have it. It seems to remove most of the performance penalty for encryption.

If you run Truecrypt and have an AES-NI processor (only Intel has them right now) then you can also make use of the acceleration.

I haven't used FreeNAS yet, but can't you maually create GELI-based "disks", then use those to create the pool?

That's the current method of supporting enc in ZFS on FreeBSD.

ZFS enc is part of ZFSv31 which is only available in Oracle Solaris 11 Express.

They said encryption in on the table for 8.1

Edit:

Apparently... future release.

Edited 2011-06-10 04:08 UTC