os/doc
3
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Update the GELI handbook to be more accurate

Browse source 
The description of the key file incorrectly identified it as the master key

PR:		208578
Submitted by:	Wout Decre <wout@canodus.be> (original version)
Reviewed by:	bcr, oshogbo
Sponsored by:	Klara Inc.
Event:		July 2020 Bugathon
Differential Revision:	https://reviews.freebsd.org/D15866
This commit is contained in:
Allan Jude 2020-07-11 16:18:22 +00:00
parent c961cecad9
commit 520477c06f
Notes: svn2git 2020-12-08 03:00:23 +00:00 
svn path=/head/; revision=54328
1 changed files with 12 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

19
en_US.ISO8859-1/books/handbook/disks/chapter.xml
View file

@ -2823,15 +2823,20 @@ device crypto</programlisting>
<step> <step>
<title>Generate the Master Key</title> <title>Generate the Master Key</title>
<para>The following commands generate a master key <para>The following commands generate a master key that all
(<filename>/root/da2.key</filename>) that is protected data will be encrypted with. This key can never be changed.
with a passphrase. The data source for the key file is Rather than using it directly, it is encrypted with one
<filename>/dev/random</filename> and the sector size of or more user keys. The user keys are made up of an
the provider (<filename>/dev/da2.eli</filename>) is 4kB as optional combination of random bytes from a file,
a bigger sector size provides better performance:</para> <filename>/root/da2.key</filename>, and/or a passphrase.
In this case, the data source for the key file is
<filename>/dev/random</filename>. This command also
configures the sector size of the provider
(<filename>/dev/da2.eli</filename>) as 4kB, for better
performance:</para>
<screen>&prompt.root; <userinput>dd if=/dev/random of=/root/da2.key bs=64 count=1</userinput> <screen>&prompt.root; <userinput>dd if=/dev/random of=/root/da2.key bs=64 count=1</userinput>
&prompt.root; <userinput>geli init -s 4096 -K /root/da2.key /dev/da2</userinput> &prompt.root; <userinput>geli init -K /root/da2.key -s 4096 /dev/da2</userinput>
Enter new passphrase: Enter new passphrase:
Reenter new passphrase:</screen> Reenter new passphrase:</screen>