implement pam_zfs_key

[felixdoerre]

I might be missing something, but it seems there is no mechanism like https://docs.oracle.com/cd/E88353_01/html/E37853/pam-zfs-key-7.html implemented for zfsonlinux. If this is already implemented, I'd be nice if you can point me to any code/documentation.

Otherwise, I'd like to help and implement such a pam module, but I have some questions, that maybe someone could answer:

• Where would I implement such a module? Somewhere in this repository?
• Should I name it identically to the version from Oracle?
• Are there any license/IP-rights issues, if I would make the zfsonlinux-pam-module behave identical to (the documentation of) the version from Oracle?
• Should I name any "additional configuration feature" identical as in the pam_zfs_key from oracle?
• For now, I would like to start with a bare minimum implementation, which would ignore all additional options to the pam module and just implement the "default"-behavior. Is that ok?

[behlendorf]

We currently don't provide a pam module as part of this repository. And to the best of my knowledge this hasn't yet been implemented by anyone for OpenZFS. That said, it sounds like a reasonable idea.

Where would I implement such a module? Somewhere in this repository?

Good question. My understanding is that it's not uncommon for packages to provide pam modules which can be optionally enabled. Though, I'm not familiar with exactly what's involved in writing one.

Should I name it identically to the version from Oracle?

The name should probably be consistent with whatever the existing naming conventions are for the Linux Pam package. Additionally, since the encryption implementation used by OpenZFS is entirely different than what's in Oracle ZFS I'd expect your Linux version would invariably be different. Providing the same functionality for the Linux PAM stack isn't an issue.

For now, I would like to start with a bare minimum implementation,

Starting with a bare bones implementation to determine how everything needs to fit together sounds like exactly the right place to start. I'm not sure how much the PAM interfaces differ across platforms, but ideally we like to be able to use the same module for FreeBSD.

Thanks for taking a look in to this missing bit of functionality.

[zdykstra]

https://github.com/BenKerry/zfscrypt is a relatively new project, but it does seem to cover some of the same bases as the feature request here.

[baryluk]

The one by BenKerry is nice but could be a scalability issue (aka slow), when one has a lot of datasets, as it scans for what to mount.

The one by felix looks to be a bit simpler, and reasonable, and scale well too. It should also mount sub-datasets, which will essentially cover all bases, unless one have some complex setup with some sub-datasets residing on a different pool, but that probably can be solve by some scripts.