Oracle Key Manager (OKM) - ZFS Encrypted Filesystem Will Not Mount Without Prompting For Passphrase After Being Imported on Second Node

Asset ID:	1-71-2032427.1
Update Date:	2016-07-29
Keywords:

Solution Type Technical Instruction Sure

Solution 2032427.1 : Oracle Key Manager (OKM) - ZFS Encrypted Filesystem Will Not Mount Without Prompting For Passphrase After Being Imported on Second Node

Applies to:

Solaris Operating System - Version 11.1 and later
Oracle Key Manager - Version 2.4.1 and later
Information in this document applies to any platform.

Goal

In an Oracle Key Manager and encrypted ZFS filesystem configuration, a filesystem will not be automatically mounted after exporting and importing onto another node. Also, when attempting to manually mount the zfs filesystem on the second node, it will prompt for the passphrase.

Recreated the issue:

1. Created the zpool_test/encryption_test filesystem on Server A.
# sudo zfs create -o encryption=aes-256-ccm -o keysource="raw,pkcs11:token=KMS;object=zfscrypto_key_256" zpool_test/encryption_test
2. The filesystem was mounted automatically on Server A.
3. Failed over (zfs export / import) to Server B.
4. The file system would not mount automatically. It would prompt for the passphrase.

Solution

This is expected behavior and how ZFS was designed to work with PKCS#11. The man page for zfs_encrypt describes some use cases for saving the PIN in a file and specifies that for PKCS#11, you specify a URI. On S12, there is a pinfile attribute described in the man page for pkcs11_parse_uri. This is not documented on S11, however, it has been verified that it is in the source code and works.

So, customers can save the PIN to a secure file location on each node and then add that to the keysource property. For example:

# echo "OKM agent PIN" > /root/okmpin (save the agent PIN. This file must be in clear text)

# chmod 400 /root/okmpin

You may need to modify the permissions on the file depending on how you are importing and exporting the zfs pool.

# zfs set keysource="raw,pkcs11:token=KMS;object=zfscrypto_key_256;pinfile=/root/okmpin" zpool_test/encryption_test

Then, you can import/export pool from any node which has the password in the pinfile, /root/okmpin, without having to remount the filesystem manually.

They will need to make this change for every encrypted filesystem.

Attachments

This solution has no attachment