[DRBD-user] DRBD on Encrypted FS

Andreas Kurz andreas.kurz at gmail.com
Fri Oct 7 23:04:36 CEST 2011

Note: "permalinks" may not be as permanent as we would like,
direct links of old sources may well be a few messages off.


hello,

On 10/06/2011 12:24 AM, Bill Asher wrote:
> Today I did a little test to see if I could configure DRBD on encrypted LVs and what I found is it didn't work for me... Because the servers are located in a colo, security for the servers is the main reasoning.
> All seems to go good until I tell DRBD to mirror filerA logical volume(/dev/vg/data) to filerB LV (/dev/vg/data).  I then received errors on the console like this, over and over:
> 
> "Block drbd0: open("/dev/vg/data") failed with -16"
> 
> I then rebooted to Ubuntu CD to look at the LVs and.. they were all gone. The only thing the partitioner sees is the two partitions I created, one for /boot the other for logical volumes, but all my lvm tables were gone.  I was able to repeat this issue on both my filers.
> 
> So my question is..
> 
> a) can this even be done, encrypting the filesystem then configureing DRBD
> b) if encryption can be done, is my approach wrong?
> 
> Thank you in advance for your time.
...

if you want to encrypt a _blockdevice_ and one possible solution is:

* encrypt a complete partition/disk with dm-crypt/LUKS/cryptsetup
* use this encrypted dm device as pv for your vg(s)
* create a lv per DRBD device

after every reboot you need to activate the encrypted partition using
cryptsetup and e.g. your passphrase and you have to do a vgscan/vgchange
prior to the activation of DRBD.

and if you own a recent Intel cpu supporting AES-NI in combination with
a recent kernel like 2.6.39 which supports multiple encryption pipes and
the aesni_intel driver, then you get a damn fast and secure replicated
storage ;-)

Regards,
Andreas

-- 
Need help with DRBD?
http://www.hastexo.com/now


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 286 bytes
Desc: OpenPGP digital signature
URL: <http://lists.linbit.com/pipermail/drbd-user/attachments/20111007/9e76c9fa/attachment.pgp>


More information about the drbd-user mailing list