FreeBSD Handbook
Prev | Chapter 19 Storage | Next

# 19.17 Encrypting Swap Space

Written by Christian Brüffer.

Swap encryption in FreeBSD is easy to configure. Depending on which version of FreeBSD is being used, different options are available and configuration can vary slightly. The gbde(8) or geli(8) encryption systems can be used for swap encryption. Both systems use the `encswap` rc.d script.

## 19.17.1 Why Should Swap be Encrypted?

Like the encryption of disk partitions, encryption of swap space is used to protect sensitive information. Consider an application that deals with passwords. As long as these passwords stay in physical memory, all is well. However, if the operating system starts swapping out memory pages to free space for other applications, the passwords may be written to the disk platters unencrypted. Encrypting swap space can be a solution for this scenario.

## 19.17.2 Preparation

> Note: For the remainder of this section, `ad0s1b` will be the swap partition.

By default, swap is unencrypted. It is possible that it contains passwords or other sensitive data in cleartext. To rectify this, the data on the swap partition should be overwritten with random garbage:

    # dd if=/dev/random of=/dev/ad0s1b bs=1m

## 19.17.3 Swap Encryption with gbde(8)

The `.bde` suffix should be added to the device in the respective `/etc/fstab` swap line:

    # Device		Mountpoint	FStype	Options		Dump	Pass#
    /dev/ad0s1b.bde		none		swap	sw		0	0

## 19.17.4 Swap Encryption with geli(8)

The procedure for instead using geli(8) for swap encryption is similar to that of using gbde(8). The `.eli` suffix should be added to the device in the respective `/etc/fstab` swap line:

    # Device		Mountpoint	FStype	Options		Dump	Pass#
    /dev/ad0s1b.eli		none		swap	sw		0	0

geli(8) uses the AES algorithm with a key length of 128 bit by default. These defaults can be altered by using `geli_swap_flags` in `/etc/rc.conf`. The following line tells the `encswap` rc.d script to create geli(8) swap partitions using the Blowfish algorithm with a key length of 128 bits and a sectorsize of 4 kilobytes, and sets “detach on last close”:

    geli_swap_flags="-e blowfish -l 128 -s 4096 -d"

Refer to the description of `onetime` in geli(8) for a list of possible options.

## 19.17.5 Verifying That it Works

Once the system has rebooted, proper operation of the encrypted swap can be verified using `swapinfo`.

If gbde(8) is being used:

    % swapinfo
    Device          1K-blocks     Used    Avail Capacity
    /dev/ad0s1b.bde    542720        0   542720     0%

If geli(8) is being used:

    % swapinfo
    Device          1K-blocks     Used    Avail Capacity
    /dev/ad0s1b.eli    542720        0   542720     0%

Prev | Home | Next
Encrypting Disk Partitions | Up | Highly Available Storage (HAST)