How to Configure Ephemeral Encrypted Swap on FreeBSD

Swap can contain passwords, keys, document fragments, and application memory that the kernel paged out. FreeBSD can place a one-time GELI encryption layer over a swap provider using a random key generated at boot. The key disappears at shutdown, which protects old swap contents—but also makes swap-backed crash dumps incompatible unless a separate dump design preserves what incident response needs.

Inventory the exact provider

Misidentifying a swap partition is destructive. Record current swap, partition labels, GEOM topology, and dump configuration:

swapinfo -h
gpart show -p
geom eli status
dumpon -l

Use GPT labels or another stable provider identity where possible. Confirm that the target is already intended solely for swap; never test swapon or GELI on a partition that might contain data. Keep console access and a tested recovery boot.

Understand one-time GELI

geli onetime creates an ephemeral .eli provider with a random key. The provider exists for that boot and cannot be reopened after the key is lost. The rc system can automate this for swap entries whose device name ends in .eli.

A typical /etc/fstab entry conceptually changes from the raw provider to its encrypted child:

/dev/gpt/swap0.eli none swap sw 0 0

On boot, the GELI swap rc logic creates /dev/gpt/swap0.eli from /dev/gpt/swap0 and then enables it. Verify current Handbook and rc.conf(5) behavior for the installed release before rebooting. geli_swap_flags can override algorithm, key length, sector size, or detach behavior, but the defaults are versioned policy; do not paste obsolete cipher flags without a requirement.

Stage the change without losing recovery

Disable the target swap provider only after confirming sufficient memory and other swap capacity:

swapoff /dev/gpt/swap0

On a busy or memory-constrained system, swapoff can fail or create severe pressure. Schedule downtime rather than forcing it. Back up /etc/fstab, edit only the intended line, and use fstab validation/swapon diagnostics supported by the release.

For a manual disposable test, follow geli(8) exactly to create a one-time provider, enable the .eli device, write controlled memory pressure, disable swap, and detach. Do not run a manual and rc-managed instance on the same provider.

Decide what happens to crash dumps

FreeBSD commonly writes kernel crash dumps to a configured dump device, often a swap partition. One-time encryption prevents recovering a dump after reboot unless dump handling uses a supported encrypted-dump mechanism and keys are preserved appropriately. The installer also warns that some mirrored/encrypted swap choices affect dump behavior.

Run:

dumpon -l
sysctl kern.shutdown.dumpdevname

Then choose deliberately: a separate dump device, supported encrypted dumps with protected key material, minidumps where appropriate, or an explicit decision not to retain dumps. Security and forensics owners should approve the tradeoff; silently disabling crash evidence is not hardening.

Clear historical plaintext appropriately

Encrypting future boots does not erase data already written to the raw swap provider. If threat model and storage type require sanitization, follow the organization’s media-sanitization policy during downtime. Repeatedly writing random data is not a universal SSD/NVMe erase guarantee because flash translation layers remap blocks.

Verify after reboot

Confirm that swapinfo lists the .eli provider, geom eli status reports it active, the raw provider is not also enabled, boot logs contain no GELI/swap errors, and crash-dump policy matches the decision. Reboot again and confirm the ephemeral provider is recreated rather than dependent on a stored passphrase.

Test low-memory behavior, shutdown, unclean reboot in a lab, and update/rollback. Monitor swap identity as well as capacity. Encrypted swap succeeds when no plaintext swap path remains and recoverability consequences are documented—not merely when .eli appears in a filename.

Related:

Sources: