ZFS dataset encryption

ZFS datasets support a host of features to help you manage your storage mounts as effectively as possible. Dataset encryption was added to ZFS in version 30 and can be enabled on a ZFS dataset during dataset creation. As ZFS on Linux in behind the official Solaris release, encryption is not available. ZFS on Linux is currently only at version 28.

You cannot encrypt an existing dataset. You would have to create a new, encrypted dataset, and migrate your data.

To create a dataset volume with encryption, use the following command. Replace [MOUNT POINT] with the location of where to mount the encrypted volume, [ZPOOL] with the name of the existing pool to use and [DATASET NAME] with the name to call the new encrypted dataset.

zfs create -o mountpoint=[MOUNT POINT] [ZPOOL]/[DATASET NAME]

For example:

zfs create -o encryption=on mountpoint=/mnt/homes datastore/homes

Now, you will be asked for a passphrase to use. Enter a passphrase, and then confirm it by typing it a second time. Your encrypted dataset will now be created.

Enter passphrase for 'datastore/homes': xxxxxxxxxxxxxxxxx
Enter again: xxxxxxxxxxxxxxxxx

Finally, check the dataset was created and encrypted:

zfs get encryption datastore/homes
NAME              PROPERTY    VALUE        SOURCE
datastore/homes   encryption  on           local

ZFS dataset compression

ZFS datasets support a host of features to help you manage your storage mounts as effectively as possible. Compression is a feature common in many file systems and it’s also included in ZFS!

See this post for information on installing ZFS and setting up a volume with a data set.

First of all, we need to identify the dataset name to apply compression with zfs list.

zfs list

With the result looking similar to below. In my example, there are three datasets; backups, binaries and homes.

NAME                 USED  AVAIL  REFER  MOUNTPOINT
datastore            312K  62.6G  38.6K  /datastore
datastore/backups   38.6K  62.6G  38.6K  /mnt/backups
datastore/binaries  38.6K  62.6G  38.6K  /mnt/binaries
datastore/homes     38.6K  62.6G  38.6K  /mnt/homes

Let’s apply compression to the datastore/homes dataset. Check to see if compression is already applied to the dataset with zfs get compression.

zfs get compression datastore/homes

Our current datastore/homes dataset is not currently compressed. To enable compression, use the zfs set command.

zfs set compression=on datastore/homes

Check the compression status again to make sure the change has taken effect.

zfs get compression datastore/homes
NAME             PROPERTY     VALUE     SOURCE
datastore/homes  compression  on        local

By default, ZFS uses gzip-6. There are various options we can use here, to override the default.

• The compression library gzip ranges from gzip-1, with the lowest compression, up to gzip-9 with the highest compression.
• ZLE is the fastest compression method but it’s only compresses one scenario – a run of zeros.
• The older library LZJB exists, however this usually offers inferior compression compared with gzip.

For a few more examples, see below.

zfs set compression=gzip-9 datastore/homes
zfs set compression=lzjb datastore/homes

Finally, to remove compression from a dataset, run:

zfs set compression=off datastore/homes