Last active
April 23, 2022 19:47
-
-
Save SoerenBusse/e7b91e1ea1e6ac68bc29b6783cf74e9a to your computer and use it in GitHub Desktop.
Ein Skript, dass den Benutzer beim Starten des Servers zur Eingabe des Passworts von verschlüsselten Datasets auffordert
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [Unit] | |
| Description=Import key for ZFS pool | |
| Documentation=man:zfs(8) | |
| DefaultDependencies=no | |
| After=systemd-udev-settle.service | |
| After=zfs-import.target | |
| After=systemd-remount-fs.service | |
| Before=zfs-mount.service | |
| [Service] | |
| Type=oneshot | |
| RemainAfterExit=yes | |
| ExecStart=/bin/bash /usr/local/bin/zfs-mount-encrypted-pools.sh | |
| [Install] | |
| WantedBy=zfs.target |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/bash | |
| # Alle Pools und Datasets auflisten, die Encryption aktiviert haben | |
| while read dataset; do | |
| # Prüfen, ob das ermittelete Dataset auch wirklich existiert | |
| encryptionroot=$(zfs get encryptionroot $dataset -H -o value) | |
| if [[ $? == 1 ]]; then | |
| echo "WARNUNG: Pool/Dataset ${dataset} konnte nicht gefunden werden" | |
| continue | |
| fi | |
| if [[ $encryptionroot != $dataset ]]; then | |
| continue | |
| fi | |
| reply=$(systemd-ask-password "Soll Dataset ${dataset} entschlüsselt werden? - N/Y eingeben:" --no-tty) | |
| if [[ $reply =~ ^[Nn]$ ]]; then | |
| continue | |
| fi | |
| while true; do | |
| for i in 1 2 3; do | |
| # Passwortabfrage | |
| password=$(systemd-ask-password "Passwort zum Entschlüsseln der Festplatten (Versuch $i/3):" --no-tty) | |
| echo $password | zfs load-key $dataset | |
| # Gab es einen Fehler beim Entschlüsseln des Dataset | |
| errorcode=$? | |
| if [[ $errorcode != 0 ]]; then | |
| echo "Fehler beim entschlüssen. Fehlercode: ${errorcode}" | |
| continue | |
| fi | |
| echo "Festplatte erfolgreich entschlüsselt" | |
| break 2 | |
| done | |
| # Passworteingabe ist 3x fehlgeschlagen | |
| reply=$(systemd-ask-password "Weiter versuchen für ${dataset}? Ein Start ohne dieses Dataset könnte Störungen verursachen (Proxmox erstellt Ordner im Mountpfad) - N/Y eingeben:" --no-tty) | |
| if [[ $reply =~ ^[Nn]$ ]]; then | |
| break | |
| fi | |
| done | |
| done <<< "$(zfs list -o name,encryption -H | grep aes | cut -f1)" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment