SV-220011r603268_rule
V-220011
SRG-OS-000404
SOL-11.1-060170
CAT III
10
The ZFS file system management profile is required.
ZFS file system encryption may only be enabled on creation of the file system. If a file system must be encrypted and is not, its data should be archived, it must be removed and re-created.
First, stop running applications using the file systems, archive the data, unmount, and then remove the file system.
# umount [file system name]
# zfs destroy [file system name]
When creating ZFS file systems, ensure that they are created as encrypted file systems.
# pfexec zfs create -o encryption=on [file system name]
Enter passphrase for '[file system name]': xxxxxxx
Enter again: xxxxxxx
Store the passphrase in a safe location. The passphrase will be required to mount the file systems upon system reboot. If automated mounting is required, the passphrase must be stored in a file.
Determine if file system encryption is required by your organization. If not required, this item does not apply.
Determine if file system encryption is enabled for user data sets. This check does not apply to the root, var, share, swap or dump datasets.
# zfs list
Using the file system name, determine if the file system is encrypted:
# zfs get encryption [filesystem]
If "encryption off" is listed, this is a finding.
V-220011
False
SOL-11.1-060170
Determine if file system encryption is required by your organization. If not required, this item does not apply.
Determine if file system encryption is enabled for user data sets. This check does not apply to the root, var, share, swap or dump datasets.
# zfs list
Using the file system name, determine if the file system is encrypted:
# zfs get encryption [filesystem]
If "encryption off" is listed, this is a finding.
M
4021