FreeBSD Encrypted Drive

Creating and mounting an encrypted UFS2 filesystem is very easy to do, and it can be automatically unlocked during boot and have a filesystem check run (fstab).

Load kernel module on boot

echo geom_eli_load="YES" >> /boot/loader.conf

Create an Encrypted Device

Create a passphrase key. Make a backup copy of it somewhere to be safe.

dd if=/dev/random bs=64 count=1 of=/root/ada1.key
geli init -s 4096 -K ada1.key /dev/ada1

Unlock the encrypted drive. This will create the device /dev/ada1.eli:

geli attach -k ada1.key /dev/ada1

Fill the new volume with random data:

dd if=/dev/random bs=1M of=/dev/ada1.eli

Format the new volume as UFS2:

newfs -U /dev/ada1.eli

After that you can mount it as normal. Add an entry to fstab:

echo "/dev/ada1.eli /private ufs rw 1 1" >> /etc/fstab

Unmount an Encrypted Device

Unmount and detach encrypted volume:

umount /private
geli detach ada1.eli

Mount Encrypted Device on Boot

Add to /etc/rc.conf:

geli_ada1_flags="-k /root/ada1.key"

On bootup, FreeBSD will ask for the passphrase.