Encrypted ZFS child Filesystem not mounted - napp-it

gea

Well-Known Member
Dec 31, 2010
2,485
837
113
DE
At the moment there is a lot of work due Corona (work planning, online/cloud access to data/ video conferencing etc).
I hope I will find some time this week to improve nested and encrypted SMB support
 

gea

Well-Known Member
Dec 31, 2010
2,485
837
113
DE
There are a lot of side effects with nested SMB filesystems.
I have improved behaviour but would not see it as final in 19.12 and 20.dev.
 

Bronko

Member
May 13, 2016
96
7
8
101
Still same behavior as mentioned in Post Post #10 when I lock/unlock manually and set 'Remember SMB share: last'.
When I choose 'Remember SMB share: off' on lock and unlock afterwards and enable SMB share manually on child enc file system, then it works as expected.

Rebooting server keeps SMB sharing on nested file system as expected too!
Thanks @gea . I'll make some further tests...
 
Last edited:

gea

Well-Known Member
Dec 31, 2010
2,485
837
113
DE
Do not enable sharing of a parent filesystem and then manually on daughter filesystems. This will give ZFS inheritance problems that I cannot solve in napp-it. Either share only the parent filesystem and traverse to deeper filesystems via this SMB share (OmniOS only, nested sharing of filesystems not supported on Solaris) or do not share the parent but the daughter filesystems only.
 

Bronko

Member
May 13, 2016
96
7
8
101
Do not enable sharing of a parent filesystem and then manually on daughter filesystems. This will give ZFS inheritance problems that I cannot solve in napp-it. Either share only the parent filesystem and traverse to deeper filesystems via this SMB share (OmniOS only, nested sharing of filesystems not supported on Solaris) or do not share the parent but the daughter filesystems only.
Locking/unlocking manually encrypted file system means to operate on parent files system for sure and I have described the SMB option in there. No need to share parent enc files system via SMB from my site. The sharing of parent enc file system wasn't wanted but happened...
 

gea

Well-Known Member
Dec 31, 2010
2,485
837
113
DE
Nested filesystems where you SMB share only the parent has the advantage that you can use different ZFS properties per child filesystem like quota or reservations or even force a filesystem to a specal vdev ex from NVMe for a better performance than the others. You should only decide if you want to share the parent with inheritance of most ZFS properties or the childs, do not mix. You should also aware that there are "toxic" ZFS properies that should not be different between parent and childs like character sets or case sensitivity.
 

Bronko

Member
May 13, 2016
96
7
8
101
... or do not share the parent but the daughter filesystems only.
Issue still present on doing exactly these on in-replicated child file system (from different host) only.

After reboot, napp-it enables parent AND child files system SMB sharing, parent wasn't SMB enabled any time before on run time, only child as the desired behavior.

PS: on a second 'control' parent and child file system combination, both directly created on host, only child is shared after reboot as expected.
 
Last edited:

Bronko

Member
May 13, 2016
96
7
8
101
...You should also aware that there are "toxic" ZFS properies that should not be different between parent and childs like character sets or case sensitivity.
Parent file system:
casesensitivity insensitive

Child file system:
casesensitivity mixed

Property on child is determined by source file system (remember replication from old storage), so I should recreate encrypted parent file system and run replication once more....? (don't like it)
 

gea

Well-Known Member
Dec 31, 2010
2,485
837
113
DE
You cannot change sensitivity after creation of a filesystem nor can you change it via replication. To change you can only copy or move data with the danger of a sensitivity conflict when there are two files in a folder like Text.doc and text.doc in a senitive filesystem. During a replication some other properties like sharing or unenrypt to encrypt can be changed.

In general, nested shared filesystems should be avoided if you cannot guarantee same properties. Shared filesystems as result of a replication should also be avoided as in such a case you have hardly control between properties that are defined from a replicated filesystem and properties that are inherited from destination parent.
 

Bronko

Member
May 13, 2016
96
7
8
101
@gea I'm testing here different cases but in regard to encryption feature of ZFS probable scenarios for more users, I believe, to migrate unencrypted to encrypted file systems. May be I'm your beta tester for napp-it handling... ;-)
 

Bronko

Member
May 13, 2016
96
7
8
101
Sometimes Encryption Setting was missing on creating file system, but it's solved on v. 20.dev 02.may.2020

But for now the settings are doubled:
Screenshot from 2020-05-12 11-47-06.png


and playing with it creates disagreements:

Screenshot from 2020-05-12 11-55-33.png


Additional question: If the 'Automount on bootup' is on 'no' at creation of file system, is it possible to enable it later at napp-it?
(on CLI: zfs set enc_automount:=yes pool/Data)
 
Last edited:

gea

Well-Known Member
Dec 31, 2010
2,485
837
113
DE
Thanks.
I am currently a little busy but try to fix problems with the new encryption feature as fast as possible.
Please re download 20.dev (may 13) where the double menu for L1: is fixed

You can enable automount manually with this user defined ZFS property.
The napp-it menu for editing is ZFS Filesystems > Encryption
 

Bronko

Member
May 13, 2016
96
7
8
101
still open issue:
parent encrypted and child file system are disabled for SMB sharing in napp-it, after reboot parent file system is shared by name -off- via SMB, but still disabled for SMB sharing.

Clicking on off for tank1/Data shows that's currently off, because it would be set to -Data-:Screenshot from 2020-06-14 13-39-14.jpg

on CLI:
Bash:
# zfs get all tank1/Data |grep smb
tank1/Data  sharesmb              name=off               local
tank1/Data  enc_smbak:            abltigWpphyF2          local
tank1/Data  enc_smbshare:         off                    local
# zfs get all tank1/Data/Photos |grep smb
tank1/Data/Photos  sharesmb              off                    local
tank1/Data/Photos  enc_smbshare:         off                    local
tank1/Data/Photos  enc_smbak:            abltigWpphyF2          inherited from tank1/Data
 
Last edited: