Securing data on GhostBSD without full disk encryption, plus enabling some Caja integration.
Note: Encryption is at dataset level.
File metadata is potentially visible, the content not.
In MATE Terminal:
1.
sudo zfs create -o encryption=aes-256-gcm -o keyformat=passphrase -o keylocation=prompt zroot/tank
Here we're using a passphrase you need to remember.
We're making the new encrypted dataset called /zroot/tank.
Parent dataset is zroot.
/tank is now encrypted.
2.
sudo zfs set mountpoint=/tank zroot/tank
We've now made the /tank locale available.
3.
sudo chown me:me /tank
Now Caja is able to let user 'me' have ownership of the encrypted dataset.
4.
sudo zfs allow me load-key,mount zroot/tank
User 'me' has credentials to open and close the encrypted dataset.
5.
sudo chmod 700 /tank
User 'me' can control the contents of the dataset with Caja.
If the key isn't loaded or the dataset mounted, Caja shows an empty folder.
- After use, securing the dataset:
A.
zfs unmount zroot/tank
to unmount the dataset,
and,
B.
zfs unload-key zroot/tank
to drop the key from memory.
Should you need to (after restart for example) open the encrypted dataset:
A.
zfs load-key zroot/tank
to load the encryption key
and
B.
sudo zfs mount zroot/tank
to mount the dataset
