Hacker News Reader

Comment by doublerebel | Hacker News Reader

I've been going over beginning a ZFS storage service for a long time, however two technical problems have held me back so far:

  * ZFS send/receive does not support pause/resume

  * SSH overhead may be overkill especially if the ZFS data is already encrypted

Therefore:

  * Do you have any plans to solve these issues?

  * Have you found them to be a problem in production?

  * Do you support encrypted ZFS?

View on HN

OpenZFS resumable send/receive is coming soon http://blog.delphix.com/matt/2015/03/25/resumable-zfs-sendre...

However, the tank/home/darren@snap1 stream is not encrypted during the send process.

http://docs.oracle.com/cd/E26502_01/html/E29007/gkkih.html

That's for Solaris only though. I wouldn't expected any other implementations to have on-the-fly encryption of that kind. So OpenSSH is unlikely to be adding overhead on that front.

Nobody outside of Oracle supports encrypted ZFS, and that's probably not going to change any time soon (I'd love to be wrong, though).

While a bit cumbersome and arguably suboptimal, at least on FreeBSD you can use geli+zfs to get full disk encryption.

Sure, but that doesn't help in the context of zfs send, which serializes at the filesystem level for transport. The stream is still going to be in plain text. In fact, Oracle's ZFS still sends the stream decrypted and decompressed, even if those properties are enabled.

Their ZFS encryption is vulnerable to watermarking attacks, so most people don't want to see it publicly used anyway.

Reply on news.ycombinator.com