I have Ubuntu Server 18.04 (18.04.1 LTS to be exact) running on my home file server (Dell Precision T3500) and I'm wondering if I can do full-disk encryption on my RAIDZ2 array (NetApp DS4243)? Ubuntu is stored on a flash drive, and the file server uses my RAIDZ2 array.
I only want to encrypt the array, so root encryption of the boot drive is not what I am looking for. I am wondering the following:
- How can I encrypt my RAIDZ2 pool?
- Can I make it automatically decrypt on startup by storing a key file on a USB drive (separate from the boot drive)?
- Can I take that USB drive out after it is finished decrypting on startup?
- Will adding new vdevs to the zpool automatically encrypt themselves?
- If I lose/replace a disk in a vdev, will that corrupt anything because of the encryption?
- Do I encrypt the disks after making the vdevs/zpool or before doing anything with ZFS?
I am essentially looking for something that requires minimal user interaction (after everything is set up of course) since the server always runs in headless mode.
I heard something about LUKS, but I haven't found any tutorials (at least up-to-date ones) that fit what I am looking for.
I also heard that ZFS will natively support encryption in the not-so-distant future. If you think it is better for me to just wait for when that day comes than to use LUKS or some other separate encryption utility that's totally fine with me. It's not mandatory for me to have encryption, I would just feel better having it if I need to RMA a drive back to WD.
Any help is greatly appreciated. Thanks!
P.S. That reminds me, if I create a zpool with
zfslinux-utils (what I'm using) and then the tool gets an update later on, will I have to destroy and recreate the zpool with the newer version?