FFS over CGD over VND example using the NetBSD operating system.
Matthew Mondor


Notes
=====

This can work over remote file systems such as through NFS, AFS,
puffs/ssh, etc.  However, if doing so care must be taken to ensure
that only one system at a time mounts the device, unless it's
mounted in read-only mode.  Otherwise, it could be catastrophic to
your data.  It is recommended to run fsirand on file systems which
are to be exported to remote boxes prior to setting up vnd images
on them.


Setup
=====

Create image file (touch + truncate would do it faster)

# dd if=/dev/zero of=/root/cgd.img bs=1m count=<megs>
# chmod 600 /root/cgd.img

Setup block layer on image file

# vnconfig -c vnd0 /root/cgd.img

Scrub the image file with random data

# cgdconfig -s cgd1 /dev/vnd0d aes-cbc 256 </dev/urandom
# dd if=/dev/zero of=/dev/cgd1d bs=1m
# cgdconfig -u cgd1

Create new configuration file for the virtual disk

# cgdconfig -g -V disklabel -o /etc/cgd/vnd0d aes-cbc 256

Create and apply the initial key.  Enter it twice.

# cgdconfig -V re-enter cgd1 /dev/vnd0d

Create a new disklabel on the crypto-device

# disklabel -iI cgd1
  Label <a> should be 4.2BSD, offset 63, and span to rest of space.
  Leave rest unchanged, and write label.

Create the new filesystem

# newfs cgd1a
# fsirand cgd1a

Unconfigure

# cgdconfig -u cgd1
# vnconfig -u vnd0
# sync

Create new fstab entry

# echo '/dev/cgd1a /cgd ffs rw,softdep,noauto 0 0' >>/etc/fstab
# mkdir /cgd
# chmod 700 /cgd


Mounting the CGD disk as /cgd:
==============================

# vnconfig -c vnd0 /root/cgd.img
# cgdconfig cgd1 /dev/vnd0d
# fsck cgd1a
# mount /cgd


Unmounting the CGD disk:
========================

# umount /cgd
# cgdconfig -u cgd1
# vnconfig -u vnd0
# sync