Lockdown adaX numbers to allow booting ?

[Michael Gmelin]

On 19. Sep 2019, at 19:15, Kurt Jaeger <lists at opsec.eu> wrote:

>>> I've made a few more details available here:
> 
>>> https://people.freebsd.org/~pi/host/gpart.txt
> 
>> What about gpart output of the pool drives?
> 
> No gpart on the bck pool, raw drives.
> 
>> In general you would create zpools using gptids or gpt labels, not the devices, so you???re independent of device numbering. The boot loader should only be installed on drives that contain the boot pool (maybe you have old boot loaders on data drives?).
> 
> I think not, because they are used as raw drives.
> 
> Maybe that decision was an error in hindsight.

Yeah, it’s not optimal that way. I made it a habit to use GPT on all pools and label partitions with the enclosure slots they’re in (makes it easier to not make mistakes in case of emergency). I also leave a bit of space at the beginning and end of the drive (allows adding in a boot partition later or more flexibility when replacing the drive).

Anyway, I’m curious what the exact problem will turn out to be.

Cheers,
Michael

> 
> -- 
> pi at opsec.eu            +49 171 3101372                    One year to go !