FreeBSD Encrypted Drive
Creating and mounting an encrypted UFS2 filesystem is very easy to do, and it can be automatically unlocked during boot and have a filesystem check run (fstab).
Load kernel module on boot
echo geom_eli_load="YES" >> /boot/loader.conf
Create an Encrypted Device
Create a passphrase key. Make a backup copy of it somewhere to be safe.
dd if=/dev/random bs=64 count=1 of=/root/ada1.key geli init -s 4096 -K ada1.key /dev/ada1
Unlock the encrypted drive. This will create the device /dev/ada1.eli:
geli attach -k ada1.key /dev/ada1
Fill the new volume with random data:
dd if=/dev/random bs=1M of=/dev/ada1.eli
Format the new volume as UFS2:
newfs -U /dev/ada1.eli
After that you can mount it as normal. Add an entry to fstab:
echo "/dev/ada1.eli /private ufs rw 1 1" >> /etc/fstab
Unmount an Encrypted Device
Unmount and detach encrypted volume:
umount /private geli detach ada1.eli
Mount Encrypted Device on Boot
Add to /etc/rc.conf:
geli_devices="ada1" geli_ada1_flags="-k /root/ada1.key"
On bootup, FreeBSD will ask for the passphrase.
