jgaunt/truenas-kmip-unlocker
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Updated to work with new config process

Browse Source
This commit is contained in:
jgaunt
2023-07-23 15:05:52 -04:00
parent fe752ff3fb
commit 13abab0b67
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
README.md
View File

@@ -1,5 +1,5 @@
# truenas-kmip-unlocker
Encrytped secrets are stored within the [secrets.ini](secrets.ini.sample) file.
Encrytped secrets are stored within the secrets.config file.
**This will work with native zfs encryption but it will only unlock the top encrypted dataset and the children must be encrypted with the same passphrase. This continues to support GELI encrpyted pools.**
@@ -26,11 +26,12 @@ suppress_ragged_eofs=True
#### Encrypt your secrets
* Encrypt your api key for truenas
* Encrypt the passphrase for your pool/dataset
* Select jail storage pool
* Encrypt your remaining pool/dataset passphrases as needed
Run the following command to encrypt your secrets, it will ask for your pool/dataset passphrase that you want to encrypt and to confirm it before outputting the encrypted passphrase. Take the encrypted secret and create a new section in the config ini file for the pool/dataset; your encrypted api key goes into the DEFAULT section. The section name will be the pool/dataset name and the only key in that section is the encrypted_key which will be this value.
Run the following command to configure your API, jail storage pool, and pool names and passphrases.
```shell
python truenas-kmip-unlock.py --encrypt
python truenas-kmip-unlock.py --config
```
#### Create Task
@@ -40,7 +41,7 @@ python /root/truenas-kmip-unlocker/truenas-kmip-unlock.py
```
#### Debugging
Nothing is logged to a file for this. Everything is output to the console. To enabled debug mode, pass the **[-v|--verbose]** argument when running the command. If the verbose argument is passed in, all passphrases will be outputted in plain text to the console. This is to ensure the decryption is working correctly.
Nothing is logged to a file for this. Everything is output to the console. To enabled debug mode, pass the **[-v|--verbose]** argument when running the command.
```python
python /root/truenas-kmip-unlocker/truenas-kmip-unlock.py --verbose
```