Raid5 + encryption + online expansion

J

jbrukardt

[H]ard|Gawd
Joined
May 28, 2005
Messages
1,494
Good morning everyone,

I have a rather unique situation which I need a solution to. My client has suddenly become paranoid and wants FDE (full disk encryption). However they also want to maintain a raid5, with online expansion.

Needless to say, this isnt exactly an every day problem, and I was wondering if you all could pose some suggestions/possible solutions.

Theyve already got an areca 1261, so thats what is doing the raid5 and online expansion, they add about a TB or so a month.


Any any all comments/suggestions welcomed

Thanks in advance
 
jbrukardt said:
Good morning everyone,

I have a rather unique situation which I need a solution to. My client has suddenly become paranoid and wants FDE (full disk encryption). However they also want to maintain a raid5, with online expansion.

Needless to say, this isnt exactly an every day problem, and I was wondering if you all could pose some suggestions/possible solutions.

Theyve already got an areca 1261, so thats what is doing the raid5 and online expansion, they add about a TB or so a month.


Any any all comments/suggestions welcomed

Thanks in advance
Click to expand...

I'd counter-suggest employing encrypting archiving software instead, or has that been ruled out? FDE just seems more hassle than its worth, esp with what I've been hearing about flaws in bitlocker. Slashdot ran an article on it awhile back I wasn't able to find it.
 
The thing is, even with encrypted volumes, that would still break online expansion to the best of my knowledge
 
You could run TrueCrypt. Make a dynamically resizing TC volume of size bigger than the array will ever get, and it'll grow as much as it needs to. Then when you resize the array, the file will stay intact and you can just let it keep growing. This won't be terribly fast, but it should be secure. Except that you'll need to either enter a key manually at every boot, or set up a key file. Thus, if the machine gets stolen with the key file still on it, or the password written in Sharpie on the front, full disk encryption has gained you nothing at all. Make sure to point this out to the client.
 
Hmm, i wasnt aware truecrypt volumes could dynamically resize, thats interesting.

Ill look into it
 
jbrukardt said:
Hmm, i wasnt aware truecrypt volumes could dynamically resize, thats interesting.

Ill look into it
Click to expand...

They can't, actually. What they do is use a feature of NTFS called "sparse files". What this does is it doesn't allocate blocks that haven't been written to. So until the file system inside the TrueCrypt volume writes to a particular block, it's not allocated on the filesystem that contains the disk image. However, there are two downsides to this: first, you have to set a capacity limit when you build the thing. If you exceed that, you'll need to create a new TC volume and copy the data from the old to the new. This will take a lot of space if you ever need to do it. Second, there's a pretty substantial performance hit when running in this mode from what I understand, especially when allocating a block that hasn't been written to yet.

They go through a TB a month of added storage requirements?! I missed that last time through. They should have a SAN setup or something - a 1261 only has room for 12 terabytes with the biggest disks out today. A system for a business that will only last a year is woefully underdesigned in my opinion.
 
Yah, this guy isnt the best planner

Once he fills up this box, he'll just build a new one. Its not even a business, it just some guy.
 
jbrukardt said:
Yah, this guy isnt the best planner

Once he fills up this box, he'll just build a new one. Its not even a business, it just some guy.
Click to expand...

Wow. That's possibly the worst expansion strategy I've ever heard.
 
jbrukardt said:
Yah, this guy isnt the best planner

Once he fills up this box, he'll just build a new one. Its not even a business, it just some guy.
Click to expand...
when he does go with new hardware, get him on a powervault MD1000

You can daisy chain them up to 3 units deep allowing for continued expansion up to like 22TB
 
Wish i could, but theres one thing you learn, you dont argue with return customers, they stop coming to you for business.

The guy likes to buy 100 bucks 500gig drives and drop em on the controller, its cheaper for him in the end, which is i think his partial motivation.
 
I second Truecrypt. I've been using it for months, and it's damn fast, hell sometimes even faster than accessing the physical drive itself! (Don't ask me how...)
 
Been posting on the truecrypt forums, and unfortunately it seems the general consensus, is that truecrypt cant do dynamic expansion unless i mess with sparse files, and thats freakin messy.
 
I didn't say it would be clean ;) Full disk encryption is a mess, and I think it'll be that way for a long time. There are very few applications where it's practical or possible to do it properly. If the key is stored on the machine, it's vulnerable - if someone physically steals the machine, the key goes with it. If the machine is on and connected to a network, it's potentially vulnerable - if someone discovers a remote vulnerability in the OS, they can log in and read files like they're not encrypted.

If you can share this information, what's stored on this and why does he want FDE for it? What advantage does he envision?
 
To the best of my knowledge, just media. He's got a bunch of HD capture equipment too, so im assuming he's capping in 1080i or something and not downconverting.

Bunch of satellite dishes (like 8 different ones) on his back porch, etc.
 
Ah, he's trying to hide from the FBI :rolleyes: Last I knew it was legal to record OTA TV... so his effort might be better spent on protecting his network connection.

He might not need to keep everything online. In that case, you can recommend this - I don't have one, but it looks like it'd be great for his purposes. You can swap out drives easily, and keep them offline and labeled for later use. Then he could encrypt each disk individually and have actual security. While encrypted volumes are mounted they're vulnerable; offline they're secure.
 
Ok, ive got some feedback that PGPdisk (or whatever its called now) will do this. However, they will not answer my emails (sent 3). although that really doesnt make me want to buy their product, id still like to know if anyone knows if it actually will perform the task i need it to.
 
Maybe this:
http://www.seagate.com/www/en-us/products/laptops/momentus/momentus_5400_fde.2/

would be an option?
Or some other hardware FDE encryption solution? I recall that Abit had a FDE passthrough device with a firewire/ USB key. That way the FDE is transparent to the RAID system and OCE should work as needed.
jbrukardt said:
Ok, ive got some feedback that PGPdisk (or whatever its called now) will do this. However, they will not answer my emails (sent 3). although that really doesnt make me want to buy their product, id still like to know if anyone knows if it actually will perform the task i need it to.
Click to expand...
If they do not answer your e-mails BEFORE the sale, imagine how well their support will be AFTER you have purchased their product...
 
You must log in or register to reply here.
Back
Top