Scripted Native: Unlocking Encrypted ZFS Root Password at Boot
This article will guide you through the process of unlocking an encrypted ZFS root password at boot time using a script. This technique can be helpful for system administrators looking to automate the decryption process during system startup, ensuring a seamless and secure boot-up experience.
Table of Contents
- Encrypted ZFS Root Configuration
- Creating the Unlock Script
- Making the Script Executable at Boot
- Customizing the Script for Your System
- Testing the Script
- Summary and References
Encrypted ZFS Root Configuration
Before creating the unlock script, you need to have a system with an encrypted ZFS root. If you haven't already set up an encrypted ZFS root, you can follow the instructions in the following resources:
Creating the Unlock Script
To create an unlock script, you can use a text editor of your choice. In the following code block, you will find an example of an unlock script. The script will prompt you for the root password, then unlock the ZFS pool using the entered password.
#!/bin/sh
# zfs-unlock-root.sh
echo "Enter your ZFS Root Password:"
read -s zfs_root_password
echo
zpool import -d /dev/zfs -R / -o canmount=noauto -O encryption=on -O password= $(echo "$zfs_root_password" | zfs key -s) rpool
The script does the following:
- Prompts for the ZFS root password using the 'read' command.
- Imports the ZFS pool in read-only mode using 'zpool import'.
- Sets the required options such as mount point (-R /), no automatic mount at boot (-o canmount=noauto), and encryption (-O encryption=on).
- Uses the 'zfs key' command to set the pool password.
Making the Script Executable at Boot
There are several ways to make the script executable at boot. One of the most convenient methods is by creating a new systemd service unit file. In the following example, a systemd unit file called zfs-unlock-root.service is used.
[Unit]
Description=Unlock ZFS Root Pool
After=zfs-import-cache.service
[Service]
Type=oneshot
ExecStart=/path/to/zfs-unlock-root.sh
[Install]
WantedBy=multi-user.target
Save the file in the /etc/systemd/system directory and then enable the service using the following command:
sudo systemctl enable zfs-unlock-root.service
Customizing the Script for Your System
The given script and unit file are examples that may need some customization based on your specific system setup. These customizations include setting the correct path for the unlock script and ensuring that the ZFS pool name matches the name used during system installation.
Testing the Script
It is recommended to test the script before relying on it during system boot. You can test by rebooting the system and observing if the pool is automatically imported and decrypted.
Summary and References
This article discussed how to create a script to unlock anencrypted ZFS root password at boot. We provided a script example and steps to make it executable at boot. The following resources were used as references:
You can explore these resources for more advanced topics related to ZFS and systemd.