General :: Performance With Software RAID5 And LUKS Encryption?
Jul 3, 2011
I have set up a Linux software RAID5 on three hard drives and want to encrypt it with cryptsetup/LUKS. My tests showed that the encryption leads to a massive performance decrease that I cannot explain. The RAID5 is able to write 187 MB/s [1] without encryption. With encryption on top of it, write speed is down to about 40 MB/s.
The RAID has a chunk size of 512K and a write intent bitmap. I used -c aes-xts-plain -s 512 --align-payload=2048 as the parameters for cryptsetup luksFormat, so the payload should be aligned to 2048 blocks of 512 bytes (i.e., 1MB). cryptsetup luksDump shows a payload offset of 4096. So I think the alignment is correct and fits to the RAID chunk size.
The CPU is not the bottleneck, as it has hardware support for AES (aesni_intel). If I write on another drive (an SSD with LVM) that is also encrypted, I do have a write speed of 150 MB/s. top shows that the CPU usage is indeed very low, only the RAID5 xor takes 14%.
I also tried putting a filesystem (ext4) directly on the unencrypted RAID so see if the layering is problem. The filesystem decreases the performance a little bit as expected, but by far not that much (write speed varying, but > 100 MB/s).
Summary:
Disks + RAID5: good
Disks + RAID5 + ext4: good
Disks + RAID5 + encryption: bad
SSD + encryption + LVM + ext4: good
The read performance is not affected by the encryption, it is 207 MB/s without and 205 MB/s with encryption (also showing that CPU power is not the problem). What can I do to improve the write performance of the encrypted RAID?
[1] All speed measurements were done with several runs of dd if=/dev/zero of=DEV bs=100M count=100 (i.e., writing 10G in blocks of 100M).
Edit: If this helps: I'm using Ubuntu 11.04 64bit with Linux 2.6.38. Edit2: The performance stays approximately the same if I pass a block size of 4KB, 1MB or 10MB to dd.
View 1 Replies
ADVERTISEMENT
Mar 26, 2010
I'm moving over to Linux when the new SSD arrives. SSD gives increased performance, so I thought that I could encrypt everything.
But then I came to think about TRIM, and garbage collection on the drive. Will a LUKS encrypted drive affect the garbage collection system? (TRIM).
View 3 Replies
View Related
May 9, 2011
first i make one partiton ten format it add mount point and fire luksopen command and create secert file and enter this in crypttab but when i rebbot it showes scert file not found and partion remain unlocked
View 1 Replies
View Related
Jun 17, 2010
1.) I am wondering how to enable the lock to an encrypted partition which has been unlocked, using luks? On boot, I am been asked automatically for the pass phrase to unlock my partitions. After doing a back up, I want lock the encrypted partition again, but I don't know the command?! I umounted the partition but after mounting it again, I was not asked for the pass phrase but had access to my data.
2.) How secure is the default fedora version of luks? Is truecrypt better?
View 2 Replies
View Related
Aug 5, 2010
I've got some old drives using pre-LUKS loopback encryption, and I'm having problems mounting them on OpenSUSE 11.3. What I expected to work, based on past experiences with other distributions, is something along the lines of:
mount -t ext3 /dev/sdc11 tmp -o loop=/dev/loop1,encryption=AES256. When I try this I'm asked for the password, but then get the message "ioctl: LOOP_SET_STATUS: Invalid argument". Anyone have a clue what could be going wrong, or how I can best access these drives from OpenSUSE?
View 5 Replies
View Related
Jan 8, 2010
When 10.04 is released I'll encrypt my /home partition using luks. I've read that xts is good for hard drive encryption and aes is good for cipher encryption. I'm looking for something that is fairly secure without sacrificing a lot of speed.
View 2 Replies
View Related
Mar 20, 2011
Is LUKS the best data/system encryption? Or is there one that is even better and stronger?
View 1 Replies
View Related
Oct 21, 2015
I would like to configure my Debian Jessie system in this way.
Two partitions:
1) /boot on /dev/sda1
2) everything else on /dev/sda2
I want to encrypt the second partition with LUKS. And then install over it a LVM volume. Inside the LVM volume i will create the / (root), /var, /opt and /home virtual partitions. In this way, i'll get asked only once for the password to decrypt all partitions. Because if i don't use LVM, then i'll get asked for the password for each encrypted partition.
I can follow and understand almost everything of this HOW-TO for Archlinux: [URL] ....
Only two passages are unclear to me:
1) Configuring mkinitcpio
I don't understand what i should do here in order to complete this. What should i do in Debian to configure "mkinitcpio"? what is the equivalent thing to do here?
I thought that the kernel would automatically recompile itself with all installed modules on the Debian system, once cryptosetup/LUKS or LVM2 get installed.
2) Configuring the boot loader
I don't understand what should i write in /etc/default/grub. Will GRUB automatically load the LUKS and LVM2 modules? Also, I don't think that i could boot the system in this way:
cryptdevice=/dev/sda2:LVM root=/dev/mapper/LVM-????
Actually the "root=" volume is the whole volume to mount as LVM. It isn't the final root partition.
View 5 Replies
View Related
Jul 19, 2010
I'm planning a fresh F13 install, with separate partitions for /boot, /home, /tmp, /, and swap. All but /boot will be logical volumes, and I'd like to encrypt all but boot. If I encrypt the underlying partitions, is there any reason to also encrypt the logical volumes themselves?
my system will be:
HP dv6-3040us Pavillion laptop
AMD Phenon II
4GB DDR3
View 3 Replies
View Related
Jun 20, 2010
I'd like to know if there's a simple way to create a LUKS encryption drive with different passwords? A real one that leads to one set of data, and another that leads to a whole different set of data. Is this even possible with LUKS?
View 1 Replies
View Related
Mar 12, 2011
I'm trying to install a luks enabled grub for full system encryption. What modules are required by grub to load a normal ubuntu linux system and what is the type to use?
View 2 Replies
View Related
Mar 5, 2010
I recently installed a new home backup server with Ubuntu 9.10 x86_64 using the alternate CD. I used the CD's installer to partition my disk and created a software RAID 5 array on 4 disks with no spares. The root file system is located outside the raid array.
At first the array performed nicely but as it started to fill up, the io performance dropped significantly to the point where I get a transfer rate of 1-2MB/s when writing!
[Code]...
View 9 Replies
View Related
Jun 8, 2010
I broke down and spent some $$ on a new server for home use. I mostly do technical research and testing, plus store movies and music. My interests are mainly in the IET iscsitarget performance.
Server system consists of an AMD Phenom II 550, 8GB RAM, 1x 80GB system partition, and a LVM-vg0 software raid5, running Ubuntu 10.04 server x64.
The vg0 consists of 3 x 500GB 7200RPM SATA drives (mdadm) sliced up with 100GB for VBox VMs, one slice is an iscsitarget for a Windows 2k3 server, and another slice iscsitarget for a desktop.
With this setup, the win2k3 server is booted from a .vdi image stored on the ext4 lvm raid5 vg0. Here are the DiskTT stats.
Code:
However, with the Win2k3 server and the MS iscsi initiator I get using DiskTT:
Code:
The speeds are incredibly slow considering a non iscsi connection is screaming fast in comparison. Any ideas?
All nics are 1GB.
Here is my ietd.conf
Code:
View 1 Replies
View Related
Jan 29, 2010
how much of a performance impact full disk encryption (say, AES 256-bit) has on disk-related activities? On one particular project I'm involved in I am trying to weigh out security vs performance issues.
View 1 Replies
View Related
Feb 14, 2010
I know how to mount it manually. I've seen a howto on how to mount it automatically by loging in with the user, you type your username and password and it mounts your encrypted partition. But that's not what I want. My idea is to call cryptsetup and mount on boot, AND ask me for passphrase like when its loading the system, then if I don't type the right password it shouldn't mount /home, even though i type the correct USER password later when the system is loaded(and then I'd have an empty /home since my home partition wasn't mounted due to wrong passphrase).
This is what I tried: I added the commands to rc.local and I don't even feel like it was executed, no passphrase was asked. As a test if commands there were being executed, I tried simple commands lile mkdir /test and it worked. So commands there are executed, yet, no passphrase was asked to me, I looked on dmesg for crypt and found nothing, I pressed alt+ctrl+F1 desiring to find a passprhase-ask and again, nothing.
View 2 Replies
View Related
Feb 3, 2010
I've been using full disk encryption with luks on two Dell laptops for about 2.5 years. One is 64 bit Fedora (upgraded to 12), another is 32 bit Ubuntu (upgraded to 9.10), both were ext3, until recently.Over time, performance degraded substantially, especially on Fedora, which was put to a heavier use. That laptop has 4 Gb RAM, two 2.5 GHz T9300 CPUs, and 56 Gb of free space.
It was especially unbearable after a reboot. Programs like firefox and thunderbird would take close to a minute to start when ran for the first time after a boot. The login process was painfully slow, and some Gnome applets (e.g. Tomboy notes, keyboard layout switcher) would fail to load on the first login, with an error. I experienced this problem on both laptops with full encryption. I had to log out and relogin to make the applets appear. I tried various boot and mount options and was thinking about switching to ecryptfs (encrypted home).
I also use 3 desktops with no encryption and a netbook with ecryptfs on /home, which all work fine. All are Dell, 2 Ubuntu and 2 Fedora. The Gnome applets problem seems to be due to slowness of the installs with the full disk encryption. The last thing I tried is to migrate ext3 to ext4. I also converted /home, /usr, /opt to extents, following[URL].. That seemed to do the trick. Gnome applets now load fine on both laptops, and startup time is back to tolerable.
Is this a typical experience: ext3 performance degradation with time and a much better performance with full disk encryption once ext3 is migrated to ext4?
View 1 Replies
View Related
Jan 9, 2010
I have no drive failures but just need to recreate a raid5 set as the next free MD disk number. Originally I built a temp OS of debian on a single drive and had 4x2TB drives in a raid5 software array (MD0) this worked fine and allowed me to move all data to it, and remove our old fileserver. I have now pulled out the 4 x 2TB Raid 5 drives and created a new OS on two new 80GB drives, partioned as follows,
MD0 is now 250mb Raid1 as /boot
MD1 is 4GB Raid1 Swap
MD2 is 76GB Raid1 as /
If I turn off and push back in the 4x2TB drives I cannot see a MD3. I presume I would need to create a MD3 from these 4 drives but I dont want to mess things up as its live data. So im here asking for help, or a bit of hand holding to get it done right.
PS - Its a Debian Lenny 5.0.3 Raid1 fresh install replacing a Debian Lenny 5.0.3 on a single disk.
View 2 Replies
View Related
Jun 30, 2011
I know you can fail and then remove a drive from a RAID5 array. This leaves the array in a degraded state.
How can you remove a drive and convert the array to just a regular, clean array?
View 9 Replies
View Related
Jul 31, 2010
I just wanted to know if having my laptop set to ondemand, will this affect performance in any way? I realize it increases the clock speed to performance when the CPU is under load, but does the time it take to go from ondemand to performance affect speed? Will there be any noticeable difference between the two setups? I have a dual core intel at 2.2GHz when in performance. When ondemand is set with no load it downclocks to 800Mhz.
View 7 Replies
View Related
May 16, 2011
I need to move a LUKS encrypted partition to the end of a harddrive to expand another partition. Does anyone know how to do this?
Is it possible to do this with other partition editing programs?
Gparted doesnt support LUKS/LVM
View 1 Replies
View Related
Jul 17, 2009
I have a 9x320G RAID5 array that I am migrating over to a 3x1.5T RAID5 array.Intermittently, a drive would drop out of the older array and it would automatically start rebuilding. I thought it was a bad cable or controller somewhere, so when I bought the three new drives, I bought a new controller for them all, too. I'm running both arrays side by side until I'm happy the new hardware is stable (one drive was DOA). Then I noticed one morning that both arrays were rebuilding themselves. This was in /var/log/messages:
Quote: Jul 5 00:30:19 mnemosyne -- MARK --
Jul 5 00:50:19 mnemosyne -- MARK --
Jul 5 01:06:02 mnemosyne kernel: md: syncing RAID array md0
[code]....
View 4 Replies
View Related
Jul 17, 2011
I managed to setup an encrypted partition that's mounted on boot using dm-crypt/LUKS.
The relevant entry from my /etc/fstab:
/dev/mapper/st_crypt /media/st ext4 defaults 0 2
The partition is mounted at boot, and I can write to it as root just fine, but I have no idea how to make it writable by a normal user (i.e the users group).
View 1 Replies
View Related
Jun 21, 2011
I've been playing with this for hours, and have been unable to figure it out. I tried to convert my RAID5 array of 4 active disks and 1 spare to a RAID6 with 5 active disks.
I did this:
Code:
mdadm --grow /dev/md4 --raid-devices 5 --level 6
Here is what I have on /dev/md4:
Code:
/dev/sde1 active
/dev/sdg1 active
/dev/sdj1 active
/dev/sdf1 active
removed
/dev/sdh5 spare
code....
but it tells me that /dev/sde is busy, and then that it has a bad superblock (From what I've read, I'm sure the bad superblock is just because of the "busy" message). I've tried this with the -f option, too, with no luck.
View 7 Replies
View Related
Aug 10, 2010
I need to restore a superblock on a RAID5 software array. But I'm not sure if I'm meant to restore it from MD0 or a device such as SDA1? From what I read, superblocks are stored on each drive, but I'm not sure if this is changed when a software raid is in use.
View 1 Replies
View Related
Aug 8, 2009
I couldn't post in General. It said I had insufficient permissions to post there, so, this post does have to do with Windows slightly. Sorry that it's here, but I DID read the rules (I searched, and couldn't find an answer to my problem either)
Anyways, I have a RAID5 array 2.72TB (4x1TB drives) which I used in my windows installation, initialized as GPT, and I used "span" to make the single 2TB partition, and 720GB partition into one partition. I believe that Windows created a software RAID0. Ok, so now I've made the leap away from windows, and am going 100% into Linux (Debian, to be exact) and I'm trying to figure out how to mount this array. I've only done basic web/ftp/ircd server management on Linux before, and never anything with mounting drives. I'm a complete n00b at this stuff.
View 9 Replies
View Related
Jun 8, 2010
I have a 2-quad core Intel Xeon system that I have set to RAID-5. I then attempted to install Ubuntu Server. When the message came up about enabling SATA RAID, I said NO because I have hardware RAID installed on the box. So I completed the install, and when I go to view the RAID configuration using the Intel Matrix Storage Manager during boot, it says:Volume0, Level: RAID5(Parity), Status: DegradedWhen I install enabling SATA RAID, I get a message asking me to "configure iSCSI volumes". When I click on that, I get another message: Loginto iSCSI targets. When I click on that I get another message: "Enter an IP address to scan for iSCSI targets". I have no idea what to put as thye iSCSI target portal address!
View 5 Replies
View Related
Jun 7, 2011
I recently upgraded a server from Fedora 6 to Fedora 14. In addition to the main hard drive where the OS is installed, I have 3 1TB hard drives configured for RAID5 (via software). After the upgrade, I noticed one of the hard drives had been removed from the raid array. I tried to add it back with mdadm --add, but it just put it in as a spare. I figured I'd get back to it later.Then, when performing a reboot, the system could not mount the raid array at all. I removed it from the fstab so I could boot the system, and now I'm trying to get the raid array back up.
I ran the following:mdadm --create /dev/md0 --assume-clean --level=5 --chunk=64 --raid-devices=3 missing /dev/sdc1 /dev/sdd1I know my chunk size is 64k, and "missing" is for the drive that got kicked out of the array (/dev/sdb1).That seemed to work, and mdadm reports that the array is running "clean, degraded" with the missing drive.However, I can't mount the raid array. When I try:mount -t ext3 /dev/md0 /mnt/fooI get:
mount: wrong fs type, bad option, bad superblock on /dev/md0,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
[code]....
View 1 Replies
View Related
Apr 4, 2010
What are my options for encrypting the /home directories of my Ubuntu laptops? They are currently setup without any encryption and some have /home as a separate partition whilst others don't. Most of these laptops are single-user standalone laptops which are out on the road a lot.
Is ecryptfs and the encrypted Private directory good enough or are there better, more secure, options? If somebody got hold of the laptop, how easy would it be for them to gain access to the encrypted files?
View 2 Replies
View Related
Jul 21, 2010
I have PDF files secured using 256-bit AES, requiring a password to open the file (Acrobat 9 or greater)
I can use Foxit Reader or Adobe Acrobat just fine on Windows, but I can't view those PDF's on Ubuntu or Mac OS X. What PDF readers for OS X and Ubuntu support 256-bit AES?
View 1 Replies
View Related
Oct 27, 2010
how to test the AES Encryption in the openSuSE 11.3
View 1 Replies
View Related