encryption

  1. R

    Issues using pvse

    Hello I am having some issues. I have several nodes in a cluster that I want local encrypted zfs pools for storage but I can't add the pools using the same name on different proxmox nodes, so I can't easily migrate between encryped zfs pools. Steps to reproduce: #1. Create the base disk in the...
  2. A

    Encrpytion light on tape drive lit?

    I just noticed when running a backup, the hardware Encryption light was lit on my drive for one of my tapes. This tape has been used without hardware encryption in the past. Has PBS made a change to the way encryption is implemented, now using the hardware encryption by default? Has PBS just...
  3. S

    Encrypting a single LXC container on LVM?

    Hey there, i'm currently trying to figure out if it's possible to encrypt a single (privileged, if that matters at all) LXC container on an unencrypted LVM-VG (currently lvm-thin)? I've got the data for that container encrypted via ZFS encryption, but unfortunately i only have ZFS on HDD and...
  4. W

    de-duplication with encryption inside vm

    Hello, I was hoping to get some clarity about backups and encryption from inside a vm. If I encrypt a debian vm with luks on lvm, will this interfere with proxmox backup server de-duplication, pruning, etc? To clarify, the encryption in not happening in proxmox, but within the vm. Any other...
  5. M

    [SOLVED] Slow ZFS encryption: will we get a fix for AVX/AVX2 not being selected?

    There is an ongoing discussion about slow encrypted ZFS performance, e.g. here: https://github.com/openzfs/zfs/issues/15245 and here: https://github.com/openzfs/zfs/issues/15276 Obviously this is due to a regression introduced in kernel 5.15.0-82 and discussed here...
  6. R

    Ceph RBD image encryption

    Hi There!, Has anyone used or had the experience of activating Ceph's RBD image encryption? RBD Image encryption What I want is to have encrypted disks of some VMs. OSD encryption doesn't solve this case, as it doesn't protect against an attacker gaining access to the host. I also had a look...
  7. N

    Need help installing Proxmox with automatic decryption and multiple drives

    I'm trying to install Proxmox on a server that is going to be running Home Assistant, a security camera NVR setup and other sensitive data, I need to have the drives be encrypted with automatic decryption of drives so the VMs can automatically resume after a power failure. # My desired setup...
  8. I

    ZFS vs. directory storage for containers

    Hi, I'm running a small PVE cluster of two nodes. Both have an encrypted ZFS dataset set up for container storage, using native ZFS encryption. This prevents migrating the containers from one node to another (https://bugzilla.proxmox.com/show_bug.cgi?id=2350). However, if I create a directory...
  9. P

    [SOLVED] Prune & GC & Verify on encrypted Backups and are the Backups still incremental

    Hello, I want to store the backups of my PVE encrypted on my PBS. I am now wondering whether the pbs can still run a prune/verify/gc on the backups, since the pbs does not have an encryption key? My second question is whether the backups are still incremental at all?
  10. J

    Zfs native encryption: difference in snapshots mounted vs unmounted?

    Since a while one of my pve hosts runs a zfs dataset with native encryption and did not have any issues so far. I've not implemented automatic loading of the key for the encrypted dataset so if the host is booted I will have to supply it myself. Now I was testing snapshots on this dataset and...
  11. K

    [SOLVED] Is corosync traffic encrypted?

    I'm looking at using a low powered QDEVICE as my third NODE in a 2 node cluster. I don't have a local connection between the nodes or the qdevice, so I'll be relying on the WAN. Is corosync traffic encrypted, or should I consider protecting it in some way ie a VPN or other tunneling technique?
  12. K

    Encrypted SMB Storage

    Hello Proxmox Community, I'm just trying to mount my SMB/CIFS Storage for my backups. For this I rent a Storage Box at Hetzner, they offer SAMBA/CIFS and more but SMB is the only method Proxmox supports of them. At the bottom of the page...
  13. T

    Mount Luks drives only inside VM not in PVE, possible?

    Hello all I'm quite new on PVE but have so far played around with 2 thin clients on driffrent vlans running a few VMs each, mostly linux dist, HASS, and a few LXC. So I have some grasp on how to find my way around. But google and the forum have failed me on this, for me, pretty important...
  14. Dunuin

    Best way to setup swap partition?

    Hi, Right now I'm writing a tutorial on how to best setup an encrypted PVE node. But the question is now how to best set up the encrypted swap? As far as I see there are 3 options and none of them is really great: Option 1.) Just a LUKS encrypted swap partition on a single disk. Not that...
  15. A

    Looking for best practices about a NAS VM and encrypted storage.

    Hello, I have a bunch of questions about setting up storage in a recommended/safest way. My end goal is that I have a NAS with a few storage "buckets" that I can mount/share into other vm's or externally via samba, nfs, etc. The tricky thing is, I want all(or some) of the storage to be...
  16. F

    Backing Up Encrypted ZFS Datasets

    Hello everyone! I am currently setting up offsite backups to a PBS instance I don't own, so I want to use client side encryption. My PVE runs on an encrypted ZFS root that it also uses for VM disks. Since ZFS supports exporting raw encrypted datasets without the key (i.e. zfs send -w), I was...
  17. P

    Proxmox is sending backup to pbs in clear text when encryption file is unavailable

    Hello everyone, I just discovered something really odd regarding the encrypted backups to pbs and I wanted to share. I have setup my encrypted backup to a locally hosted pbs instance. The encryption key is stored in client at etc/pve/priv/storage/<STORAGE-ID>.enc. If you remove this file...
  18. W

    Cloud-Init LUKS VM Setup?

    Hello all, I have seen an understand the benefits of setting up a base image/template with Cloud-Init, so similar VMs can very easily be setup when needed. My question is... can these Cloud-Init template/images can be setup with LUKS encryption without losing any features? Will it still be able...
  19. F

    Snapshot / backup encryption

    The documentation talks about enabling encrypted snapshots when using Proxmox Backup Server, but doesn't mention enabling encryption for backup up elsewhere (for example, to a SMB server). Is there any way to enable encryption on all snapshots? I'm hoping to use the web interface to set up...
  20. K

    [SOLVED] Questions regarding encryption

    Hi, i got 2 questions to properly secure my data. The setup is one server running PVE an another server running PBS. All on premise. The VMs are stored on thin-provisioned LVMs that are encrypted using LUKS. The key is stored on a hardware token. I am really happy with that. Works great and...

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!