Skip to main content

Self-Encrypting Drives

Self-Encrypting Drives

A self-encrypting drive (SED) encrypts everything written to it in its own hardware, and needs a password before it will unlock and expose its data. This page covers the SED-specific parts of the drive lifecycle: finding out which of your drives support it, setting the password, unlocking drives after they've locked themselves, and the PSID-based recovery path for when the password is lost.

SED initialization has to happen before you approve the drive into a pool —— once a SED drive is approved, StorONE no longer lets you set its password (see Drives for the approval workflow). If you're planning to use SED, set the password as one of your first steps after racking new drives, before approving anything.

Listing self-encrypting drives

Use this to see which of your drives are SED-capable in the first place —— not every drive is.

Using the web interface

Open Inventory > Resources > Drives and filter to self-encrypting drives, or check the SED indicator in the drive details.

Using the CLI

resources drives sed list [--node=<name>]
Option Description
--node=<name> Show results from a specific node. If omitted, the first available node is used.

Example

resources drives sed list

Initializing SED drives with a password

This sets the encryption password on newly installed, not-yet-approved SED drives. All self-encrypting drives on the system share the same password —— you can't set a different password per drive. Losing this password locks you out of the drives' data permanently (short of the PSID reset described below, which destroys the data instead of recovering it), so treat it like any other credential you can't afford to lose.

Using the web interface

  1. Open Inventory > Resources > Drives.
  2. Under Drive Selection, choose the SED drives to initialize (by ID, or all).
  3. Enter and confirm the password.
  4. Confirm to initialize.

Using the CLI

resources drives sed initialize (--driveIds=<numbers...>|--all) --password=<password> --confirmPassword=<password>
Option Description
--driveIds=<numbers...> Initialize self-encrypting drives with these ids.
--all Initialize all self-encrypting drives.
--password=<password> The password used to initialize the self-encrypting drives. Must be the same password for all self-encrypting drives on this system.
--confirmPassword=<password> Re-enter the password to confirm.

Examples

Initialize two specific SED drives before approving them:

resources drives sed initialize --driveIds 20,21 --password "correct-horse-battery-staple" --confirmPassword "correct-horse-battery-staple"

Initialize every SED drive currently detected on the system:

resources drives sed initialize --all --password "correct-horse-battery-staple" --confirmPassword "correct-horse-battery-staple"

Supplying the password to unlock SED drives

Self-encrypting drives lock themselves automatically on power loss —— that's the whole point of the feature. After a node reboots or a power cycle, the SED drives need the password supplied again before StorONE can use them. Use this command to unlock them across all currently available nodes in one step.

Using the web interface

Open Inventory > Resources > Drives and use the Supply SED Password action.

Using the CLI

resources drives sed supply_password --password=<password>
Option Description
--password=<password> The password used to unlock the self-encrypting drives.

Example

resources drives sed supply_password --password "correct-horse-battery-staple"

Erasing a SED drive with its PSID

If you've lost the SED password, the drive is otherwise unrecoverable through normal means —— the PSID erase is the exception. Every self-encrypting drive has a PSID (Physical Secure ID) printed on its label, which lets you cryptographically reset the drive back to its factory, unlocked state without knowing the current password. This is a last resort: it permanently destroys whatever data was on the drive. It only works on a drive that isn't currently approved.

Using the web interface

  1. Open Inventory > Resources > Drives.
  2. Select the drive and use the SED Erase action.
  3. Enter the drive's PSID (from its physical label).
  4. Confirm —— this cannot be undone.

Using the CLI

resources drives sed erase --driveId=<numbers> --psid=<text> [--force]
Option Description
--driveId=<numbers> Erase a self-encrypting drive with this id.
--psid=<text> The drive's PSID, used to authorize the erase.
--force Skip the confirmation prompt.

Example

resources drives sed erase --driveId 20 --psid ABCD1234EFGH5678IJKL9012MNOP3456

Next: Network —— enabling iSCSI/NVMeOF traffic on specific IPs.

See also: Drives