Learn Linux Filesystem - Quota, Encryption & Integrity

#Introduction

A healthy filesystem isn't just about speed — it must also be controlled, confidential, and verified. These three properties are maintained by three different mechanisms: quotas to limit space usage, encryption to protect data when a disk is stolen, and checksum scrubs to detect invisible corruption.

Episode 8 covers all three practically. We start with quotas on ext4/XFS and qgroups on btrfs, then encryption with LUKS and ZFS native encryption, and finish with scheduling scrubs to maintain long-term integrity.

This is the foundation of what will become the production hardening checklist in episode 21. Because the topic is sensitive, all experiments happen on a loopback disk, not on production data.

#Quota: Controlling Capacity

#User and Project Quotas on ext4/XFS

Quotas limit the number of blocks and inodes that can be used. Two common types: user quota (per file owner) and project quota (per project directory). For ext4, enable it at mkfs time or with tune2fs:

Aktifkan quota ext4

sudo tune2fs -O quota /dev/loop0
sudo mount -o usrquota,grpquota /dev/loop0 /mnt/lab
sudo quotacheck -ugm /mnt/lab

After mounting, set limits with edquota or directly with setquota:

Set quota user 1GB

sudo setquota -u arman 0 1048576 0 0 /mnt/lab

The second number 1048576 is the soft limit in 1KB blocks (1GB); the hard limit follows. On XFS, quota is active by default through mount options:

Mount XFS dengan project quota

sudo mount -o pquota /dev/loop0 /mnt/lab
sudo xfs_quota -x -c 'limit -p bsoft=1g bhard=2g proyek1' /mnt/lab

The xfs_quota command is XFS's official tool for managing project-based quotas.

#btrfs qgroups

btrfs uses qgroups (quota groups) based on a subvolume hierarchy:

Aktifkan qgroup dan set limit

sudo btrfs quota enable /mnt/lab
sudo btrfs qgroup create 1/100 /mnt/lab
sudo btrfs qgroup limit 1G 1/100 /mnt/lab
sudo btrfs qgroup show /mnt/lab

qgroups account for usage while considering COW-shared data between snapshots — something traditional quotas can't do. Check usage with btrfs qgroup show.

#Encryption: Protecting Data at Rest

#dm-crypt and LUKS

LUKS (Linux Unified Key Setup) is the standard for full-disk encryption based on dm-crypt. Format, open, and create a filesystem on top:

Enkripsi disk dengan LUKS

sudo cryptsetup luksFormat /dev/loop0
sudo cryptsetup open /dev/loop0 rahasia
sudo mkfs.ext4 /dev/mapper/rahasia

The encrypted device appears as /dev/mapper/rahasia — on top of it you're free to create any filesystem. Check the status:

Status LUKS

sudo cryptsetup status rahasia
sudo cryptsetup luksDump /dev/loop0

cryptsetup luksDump shows the cipher, key size, and key slots. Keep a backup of the LUKS header — without it, data can't be decrypted even with the correct password.

#ZFS Native Encryption

ZFS has native encryption at the dataset level:

Dataset ZFS terenkripsi

sudo zfs create -o encryption=aes-256-gcm -o keyformat=passphrase labpool/rahasia
sudo zfs mount -l labpool/rahasia

-l prompts for the passphrase at mount time. ZFS uses AES-GCM and on OpenZFS 2.4 it's accelerated with AVX2 instructions, so the encryption overhead is very low on modern hardware. The key is cached by ZFS and can be loaded automatically via zfs load-key.

#btrfs Native Encryption

btrfs native encryption is still experimental and not safe for production. For btrfs, the correct encryption is via LUKS underneath — not an internal feature. Remember this rule when planning architecture: choose ZFS if you want native encryption, or wrap ext4/XFS/btrfs with LUKS.

#Integrity: Detecting Silent Corruption

#What Is Silent Corruption

Silent corruption is data change that no one notices: bit flips from radiation, slowly failing bad sectors, or firmware bugs. Traditional filesystems don't detect it until the data is needed and fails. Checksums solve this problem — every block stores its verifier.

#Scheduled Scrub

Both btrfs and ZFS provide scrub, which reads all data to verify checksums and repair damaged blocks from healthy copies:

Scrub btrfs dan ZFS

sudo btrfs scrub start /mnt/lab
sudo zpool scrub labpool

Scrub should be scheduled regularly. Use cron or a systemd timer:

Jadwal scrub mingguan via cron

30 2 * * 0 sudo btrfs scrub start /mnt/lab
30 3 * * 0 sudo zpool scrub labpool

Check the scrub results:

Lihat hasil scrub

sudo btrfs scrub status /mnt/lab
sudo zpool status labpool

The CKSUM and REPAIR columns in zpool status show how many blocks failed and were recovered. A constantly increasing non-zero number is an early sign of a dying disk.

Tip

For ext4 and XFS, which don't have data checksums, pair SMART monitoring and regular backups as a scrub replacement. Detection comes late, so protect with backups.

#Conclusion

Quota, encryption, and scrub are three different layers of filesystem defense: quotas control space abuse, encryption protects against physical theft, and scrub catches invisible corruption. All three must be considered before a system goes to production.

Key takeaways:

Quotas limit blocks and inodes; XFS has xfs_quota, btrfs uses qgroups that understand COW-shared data.
LUKS is the full-disk encryption standard; ZFS native encryption uses AES-GCM.
btrfs native encryption is still experimental — use LUKS underneath.
Scrub reads all data and verifies checksums; ZFS repairs automatically from mirror/parity.
Schedule regular scrubs via cron or a systemd timer.
ext4/XFS have no data checksums — rely on SMART and backups.

In the next episode, episode 9, we cover snapshots, backups, and replication — from LVM snapshots and fs-freeze for ext4/XFS, instant btrfs and ZFS snapshots, to incremental btrfs send/receive and zfs send/receive patterns for offsite backup. You'll learn to protect data from loss, not just corruption.