Page MenuHomeFreeBSD
Files F160292361

D47996.id147713.diff
No OneTemporary
Actions

D47996.id147713.diff
View Options

diff --git a/lib/libpam/pam.d/login b/lib/libpam/pam.d/login
--- a/lib/libpam/pam.d/login
+++ b/lib/libpam/pam.d/login
@@ -4,6 +4,7 @@
#
# auth
+#auth optional pam_zfs_key.so homes=zroot/home
auth sufficient pam_self.so no_warn
auth include system
@@ -13,6 +14,7 @@
account include system
# session
+#session optional pam_zfs_key.so homes=zroot/home
session include system
# password
diff --git a/lib/libpam/pam.d/passwd b/lib/libpam/pam.d/passwd
--- a/lib/libpam/pam.d/passwd
+++ b/lib/libpam/pam.d/passwd
@@ -7,4 +7,5 @@
# password
#password requisite pam_passwdqc.so enforce=users
+#password optional pam_zfs_key.so homes=zroot/home
password required pam_unix.so no_warn try_first_pass nullok
diff --git a/usr.sbin/adduser/adduser.8 b/usr.sbin/adduser/adduser.8
--- a/usr.sbin/adduser/adduser.8
+++ b/usr.sbin/adduser/adduser.8
@@ -27,7 +27,7 @@
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
-.Dd December 1, 2024
+.Dd December 6, 2024
.Dt ADDUSER 8
.Os
.Sh NAME
@@ -144,6 +144,29 @@
I have been using this model for almost 10 years and found that it works
for most situations, and has never gotten in the way.
(Rod Grimes)
+.Sh ZFS ENCRYPTION
+If ZFS encryption is enabled on the users home dataset,
+.Xr zfs-load-key 8
+must be run against it before mounting.
+It can either be run manually after login or setup to run at
+login with the pam_zfs_key.so
+.Xr openpam 3
+module.
+.sp
+To configure
+.Xr zfs-load-key 8
+to run at login,
+uncomment lines that mention pam_zfs_key.so in the /etc/pam.d/login and
+/etc/pam.d/passwd files.
+Note that changing the user password with
+.Xr passwd 1
+does not update the zfs encryption key.
+Use
+.Xr zfs-change-key 8
+to set the encryption key.
+For auto mounting an encrypted dataset at login to work with pam_zfs_key.so,
+the encryption key and user password must be identical.
+Logins via SSH will not auto mount the encrypted dataset.
.Sh CONFIGURATION
The
.Nm
diff --git a/usr.sbin/adduser/adduser.sh b/usr.sbin/adduser/adduser.sh
--- a/usr.sbin/adduser/adduser.sh
+++ b/usr.sbin/adduser/adduser.sh
@@ -257,7 +257,8 @@
# create ZFS dataset before home directory is created with pw
if [ "${Zcreate}" = "yes" ]; then
if [ "${Zencrypt}" = "yes" ]; then
- echo "Enter encryption keyphrase for ZFS dataset (${zhome}):"
+ echo "Enter encryption keyphrase for ZFS dataset"
+ echo "(Must be identical to password for auto mount at login) (${zhome}):"
fi
if [ -n "$BSDINSTALL_CHROOT" ]; then
create_zfs_chrooted_dataset
@@ -635,7 +636,7 @@
#
get_zfs_encryption() {
local _input= _prompt=
- _prompt="Enable ZFS encryption? (yes/no) [${Zencrypt}]: "
+ _prompt="Enable ZFS encryption? (To auto mount at login, see adduser(8)) (yes/no) [${Zencrypt}]: "
while : ; do
echo -n "$_prompt"
read _input
@@ -699,7 +700,7 @@
# Give new user ownership of newly created zfs dataset.
#
set_zfs_perms() {
- if ! ${ZFSCMD} allow "${username}" create,destroy,mount,snapshot "${zhome}"; then
+ if ! ${ZFSCMD} allow "${username}" create,destroy,mount,snapshot,load-key,change-key "${zhome}"; then
err "There was an error setting permissions on ZFS dataset (${zhome})."
return 1
fi

File Metadata

Mime Type
text/plain
Expires
Wed, Jun 24, 12:06 AM (21 h, 33 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
34264447
Default Alt Text
D47996.id147713.diff (3 KB)

Event Timeline