Full Disk Encryption

winnie

Hey y'all I just installed ghostbsd and I'm hoping there might be some way to encrypt my disk on the fly. However the port for veracrypt does not have a system tab for encypting your full system and when I go to create a volume that is non-system in order to encrypt the whole disk it says broken pipe so idk let me know what options yall know about I tried for a second to just install midnightbsd but I just librebooted my computer and i cant get freebsd text installers to boot right. thanks in advance to anyone who has any type of guidance

winnie

update i ran it as root and got passed the broken pipe issue but veracrypt will not comply if anyone knows of a guide for how to encrypt my filessytem and storage youd be my hero

teekay

I personally don't use full disk encryption, but instead I encrypt a specific folder in my home directory using encfs. For full disk encryption, I would look into zfs encryption.

grahamperrin

⚙ D47996 adduser(8): Add documentation for ZFS encrypted home dataset

vimanuelt

If you want FDE in the standard install, just submit a feature request at ghostbsd/issuesissues/new?assignees=&labels=feature&template=feature_request.yaml

grahamperrin

vimanuelt … submit a feature request …

Already submitted (2021):

[Feature] Full system encryption using GELI · Issue #68 · ghostbsd/issues

vimanuelt

@"grahamperrin" #p1625
There have been long discussions about GELI integration. What we found was that GELI works best with UFS, not ZFS, due to how it operates at the block device layer. GELI encrypts entire partitions or disks, which complements UFS well since UFS does not have built-in encryption. However, when used with ZFS, which has its own native encryption features at the dataset level, GELI can introduce redundant layers of complexity without clear advantages.

Since GhostBSD uses ZFS exclusively, relying on ZFS native encryption offers better integration, easier key management, support for encrypted datasets with snapshots and clones, and more efficient performance due to its awareness of the filesystem structure. For these reasons, using ZFS encryption by default is a more practical and maintainable solution for GhostBSD users.

grahamperrin

vimanuelt … discussions about GELI integration. …

In the forums?

vimanuelt

grahamperrin
This discussion has been ongoing for several years, much of it originally taking place in GhostBSD’s now-defunct Telegram lobby. Some key points still remain in the relevant GitHub issue.

Going forward, we should adopt a more sustainable approach: use GitHub issues and the GhostBSD-Dev Telegram group for all technical discussions. GitHub offers structured threads, searchable history, and improved visibility; unlike the general Telegram group or forums, where important conversations are often lost.

We already have procedures for submitting bug reports and feature requests on GitHub. It may be worth introducing a third category: support tickets. This would allow users to seek help directly through GitHub instead of using the forums or general Telegram group, making it easier to track and revisit recurring issues.

To support this shift, I’ll refrain from posting technical issues in the general GhostBSD forums or Telegram group, as those conversations are too easily buried. 🙂

grahamperrin

vimanuelt … we should adopt a more sustainable approach: use GitHub issues and the GhostBSD-Dev Telegram group for all technical discussions. GitHub offers structured threads, searchable history, and improved visibility; unlike the general Telegram group or forums, where important conversations are often lost.

We already have procedures for submitting bug reports and feature requests on GitHub. It may be worth introducing a third category: support tickets. This would allow users to seek help directly through GitHub instead of using the forums or general Telegram group, making it easier to track and revisit recurring issues.

To support this shift, I’ll refrain from posting technical issues in the general GhostBSD forums or Telegram group, as those conversations are too easily buried. 🙂

Why not use GhostBSD Forums for technical discussion?

GitHub issues are not well-suited to conversation. Neither are GitHub discussions.

michaelcarlos

It seems like you're experiencing some trouble with disk encryption on GhostBSD. As Veracrypt's port is not performing full-system encryption on the fly and you're getting the "broken pipe" error, an option that you may want to look into is using GBDE (Geometric Block Device Encryption) or ZFS encryption (if you're having ZFS as your filesystem). GBDE can be utilized for disk encryption on FreeBSD-based operating systems such as GhostBSD, although it's slightly more hands-on to install. For ZFS, if you are using it, it comes with native encryption, which can be activated at the time of installation. Also, if you are remaining with GhostBSD and Libreboot, it may be a good idea to make sure your bootloader and BIOS configuration are set correctly for FreeBSD's bootloader in order for it to function properly. If you’re still looking for alternatives, a good forum to check out is the GhostBSD or FreeBSD Reddit for more specific advice.