# geli encrypted disk



## BiZoNiX (Jun 9, 2014)

Hello everyone!
I decided to encrypt the second non-bootable hard drive in the system.
it is unclear why the system during boot asks to enter the password, even though I do not want that this hard drive loaded with the system.

Nowhere to configure autostart nor /etc/rc.conf.[local], /boot/load.conf nor any fstab. FreeBSD 8.4 system.

How do I disable the password prompt at startup?

```
root@fbsd:/root # dd if=/dev/random of=crypto.key bs=64 count=1
root@fbsd:/root # geli init -b -s 4096 -K crypto.key /dev/ad6s1
root@fbsd:/root # geli attach -k crypto.key /dev/ad6s1
root@fbsd:/root # dd if=/dev/random of=/dev/ad6s1.eli bs=1m
root@fbsd:/root # newfs /dev/ad6s1.eli
root@fbsd:/root # mkdir /private
root@fbsd:/root # mount /dev/ad6s1.eli /private
root@fbsd:/root # geli detach /dev/ad6s1.eli
```

Sorry for my English.


----------



## wblock@ (Jun 9, 2014)

It's possible there is an automounter involved, especially if a desktop environment is installed.


----------



## asteriskRoss (Jun 9, 2014)

Your GELI device is attaching on boot because that is what you asked for with the _-b_ flag when you initialised it   From the geli(8) man page:


> The first argument	to geli	indicates an action to be performed:
> init	Initialize the provider	which needs to be encrypted.
> [...]
> Additional options include:
> ...



This is no big problem as you can reconfigure so it no longer attaches on boot (you need to attach it first):

```
# geli attach -k crypto.key /dev/ad6s1
# geli configure -B /dev/ad6s1.eli
```

To configure any future GELI devices like that from the start, just exclude the _-b_ flag when initialising the device with `geli init`.


----------



## wblock@ (Jun 9, 2014)

@asteriskRoss, pretend there was a Thanks button on your post and I just clicked it.  :beergrin


----------



## BiZoNiX (Jun 9, 2014)

Yes you were right, the problem was in the key b,
Decided: 
`# echo kern.geom.eli.tries=0 >> /boot/loader.conf`
and after boot 
`# geli attach -k crypto.key /dev/ad6s1
# geli configure -B /dev/ad6s1.eli`


----------



## asteriskRoss (Jun 10, 2014)

@wblock@, I will happily consider myself thanked.  :beer


----------

