Index: en_US.ISO8859-1/books/handbook/disks/chapter.xml =================================================================== --- en_US.ISO8859-1/books/handbook/disks/chapter.xml +++ en_US.ISO8859-1/books/handbook/disks/chapter.xml @@ -2878,7 +2878,7 @@ This section demonstrates how to configure an encrypted swap partition using &man.gbde.8; or &man.geli.8; encryption. It assumes a UFS file system where - /dev/ad0s1b is the swap partition. + /dev/ada0s1b is the swap partition. Configuring Encrypted Swap @@ -2888,34 +2888,73 @@ the current swap partition with random garbage, execute the following command: - &prompt.root; dd if=/dev/random of=/dev/ad0s1b bs=1m + &prompt.root; dd if=/dev/random of=/dev/ada0s1b bs=1m To encrypt the swap partition using &man.gbde.8;, add the .bde suffix to the swap line in /etc/fstab: # Device Mountpoint FStype Options Dump Pass# -/dev/ad0s1b.bde none swap sw 0 0 +/dev/ada0s1b.bde none swap sw 0 0 To instead encrypt the swap partition using &man.geli.8;, use the .eli suffix: # Device Mountpoint FStype Options Dump Pass# -/dev/ad0s1b.eli none swap sw 0 0 +/dev/ada0s1b.eli none swap sw 0 0 By default, &man.geli.8; uses the AES - algorithm with a key length of 128 bit. These defaults can be - altered by using geli_swap_flags in - /etc/rc.conf. The following flags - configure encryption using the Blowfish algorithm with a key - length of 128 bits and a sectorsize of 4 kilobytes, and sets - detach on last close: + algorithm with a key length of 256 bits. These defaults can + be altered in the options field in + /etc/fstab. The possible flags + are: + + + + aalgo + + Data integrity verification algorithm used to ensure + that the encrypted data has not been tampered with. See + &man.geli.8; for a list of supported algorithms. + + + + + ealgo + + Encryption algorithm used to protect the data. See + &man.geli.8; for a list of supported algorithms. + + + + + keylen + + The length of the key used for the encryption + algorithm. See &man.geli.8; for the key lengths that + are supported by each encryption algorithm. + + + + + sectorsize + + The size of the blocks data is broken into before + it is encrypted. Larger sector sizes increase + performance at the cost of higher storage + overhead. The recommended size is 4096 bytes. + + + + + This example configures an encryped swap partition using + the Blowfish algorithm with a key length of 128 bits and a + sectorsize of 4 kilobytes: - geli_swap_flags="-e blowfish -l 128 -s 4096 -d" + # Device Mountpoint FStype Options Dump Pass# +/dev/ada0s1b.eli none swap sw,ealgo=blowfish,keylen=128,sectorsize=4096 0 0 - Refer to the description of onetime in - &man.geli.8; for a list of possible options. @@ -2929,13 +2968,13 @@ &prompt.user; swapinfo Device 1K-blocks Used Avail Capacity -/dev/ad0s1b.bde 542720 0 542720 0% +/dev/ada0s1b.bde 542720 0 542720 0% If &man.geli.8; is being used: &prompt.user; swapinfo Device 1K-blocks Used Avail Capacity -/dev/ad0s1b.eli 542720 0 542720 0% +/dev/ada0s1b.eli 542720 0 542720 0%