3 ms·

Do you have to end the key in the remote machine to send it encrypted backups? Can you merge in incremental sends without decrypting the backup on the remote ma

by mavhc 6y ago

Do you have to end the key in the remote machine to send it encrypted backups? Can you merge in incremental sends without decrypting the backup on the remote machine?

wumms 6y ago
Current OpenZFS supports zfs send -w: "-w, -raw For encrypted datasets, send data exactly as it exists on disk. This allows backups to be taken even if encryption keys are not currently loaded. The backup may then be received on an untrusted machine since that machine will not have the encryption keys to read the protected data or alter it without being detected. Upon being received, the dataset will have the same encryption keys as it did on the send side, although the keylocation property will be defaulted to prompt if not otherwise provided. For unencrypted datasets, this flag will be equivalent to -Lec Note that if you do not use this flag for sending encrypted datasets, data will be sent unencrypted and may be re-encrypted with a different encryption key on the receiving system, which will disable the ability to do a raw send to that system for incrementals." Source: https://zfsonlinux.org/manpages/0.8.5/man8/zfs.8.html https://zfsonlinux.org/manpages/0.8.5/man8/zfs.8.html
- mavhc 6y ago
  This would seem to make it the best backup system, you can merge your incremental backups over time, so never have to reset, without requiring any backup storage software on the remote computer, and it's never decrypted
  - jonmon6691 6y ago
    I totally agree. I actually just built some scripts to do this using rclone, but they could easily be modified to work with a remote ZFS which is actually way more ideal. It is encrypted in-flight, and at rest on the remote, and merging block-level increments never require decryption. My key never has to leave my local machine. https://github.com/jonmon6691/storage_architecture https://github.com/jonmon6691/storage_architecture
    - Fnoord 6y ago
      Tools like Duplicati and Cryptomator also allow this. I'm using Jottacloud, 7,50 EUR for 5 TB (actually 'unlimited' but the speed gets slower after 5 TB). Rclone also has support for Jottacloud. Nice thing about Jottacloud is its hosted on Norway. They got privacy laws there. I know if you encrypt in-flight without having your private key remotely this is far less important, but still. Arguably, these products are therefore competitors.
radious_co 6y ago
Yup. I believe ZFS supports sending incremental snapshots without having the decryption key. However, it become a pain-in-the-ass if you have recursive snapshots where only some of the datasets are encrypted. I think... in order to accomplish this, you need to send separate batches of snapshots... one for each set of encrypted vs. decrypted. E.g. /zpool/tmp # not encrypted /zpool/home/someone # not encrypted /zpool/home/someone/thunderbird # encrypted $ zfs snapshot -r /zpool zpool@today # this will probably bork $ zfs send -v -w -R -I zpool@yesterday zpool@today | ... # but this will work $ zfs send -v -R -I zpool/tmp@yeserday zpool/tmp@today | ... $ zfs send -v -R -I zpool/home/someone@yeserday zpool/home/someone@today | ... $ zfs send -v -w -R -I zpool/home/someone/thunderbird@yeserday zpool/home/someone/thunderbird@today | ... NOTE: I haven't fully explored this. But from experience, loading the key on the remote solves a lot of problems. The most import feature of encryption for us is encryption-at-rest. I just want to pull the AC plug and ensure that the data is protected.
- radious_co 6y ago
  https://www.google.com/search?client=firefox-b-1-d&q=zfs+reddit+send+incremental+encrypted https://www.google.com/search?client=firefox-b-1-d&q=zfs+red...

by mavhc 6y ago

Do you have to end the key in the remote machine to send it encrypted backups? Can you merge in incremental sends without decrypting the backup on the remote machine?

wumms 6y ago

Current OpenZFS supports zfs send -w: "-w, -raw For encrypted datasets, send data exactly as it exists on disk. This allows backups to be taken even if encryption keys are not currently loaded. The backup may then be received on an untrusted machine since that machine will not have the encryption keys to read the protected data or alter it without being detected. Upon being received, the dataset will have the same encryption keys as it did on the send side, although the keylocation property will be defaulted to prompt if not otherwise provided. For unencrypted datasets, this flag will be equivalent to -Lec Note that if you do not use this flag for sending encrypted datasets, data will be sent unencrypted and may be re-encrypted with a different encryption key on the receiving system, which will disable the ability to do a raw send to that system for incrementals." Source: https://zfsonlinux.org/manpages/0.8.5/man8/zfs.8.html https://zfsonlinux.org/manpages/0.8.5/man8/zfs.8.html

mavhc 6y ago
This would seem to make it the best backup system, you can merge your incremental backups over time, so never have to reset, without requiring any backup storage software on the remote computer, and it's never decrypted
- jonmon6691 6y ago
  I totally agree. I actually just built some scripts to do this using rclone, but they could easily be modified to work with a remote ZFS which is actually way more ideal. It is encrypted in-flight, and at rest on the remote, and merging block-level increments never require decryption. My key never has to leave my local machine. https://github.com/jonmon6691/storage_architecture https://github.com/jonmon6691/storage_architecture
  - Fnoord 6y ago
    Tools like Duplicati and Cryptomator also allow this. I'm using Jottacloud, 7,50 EUR for 5 TB (actually 'unlimited' but the speed gets slower after 5 TB). Rclone also has support for Jottacloud. Nice thing about Jottacloud is its hosted on Norway. They got privacy laws there. I know if you encrypt in-flight without having your private key remotely this is far less important, but still. Arguably, these products are therefore competitors.

radious_co 6y ago

Yup. I believe ZFS supports sending incremental snapshots without having the decryption key. However, it become a pain-in-the-ass if you have recursive snapshots where only some of the datasets are encrypted. I think... in order to accomplish this, you need to send separate batches of snapshots... one for each set of encrypted vs. decrypted. E.g. /zpool/tmp # not encrypted /zpool/home/someone # not encrypted /zpool/home/someone/thunderbird # encrypted $ zfs snapshot -r /zpool zpool@today # this will probably bork $ zfs send -v -w -R -I zpool@yesterday zpool@today | ... # but this will work $ zfs send -v -R -I zpool/tmp@yeserday zpool/tmp@today | ... $ zfs send -v -R -I zpool/home/someone@yeserday zpool/home/someone@today | ... $ zfs send -v -w -R -I zpool/home/someone/thunderbird@yeserday zpool/home/someone/thunderbird@today | ... NOTE: I haven't fully explored this. But from experience, loading the key on the remote solves a lot of problems. The most import feature of encryption for us is encryption-at-rest. I just want to pull the AC plug and ensure that the data is protected.

radious_co 6y ago
https://www.google.com/search?client=firefox-b-1-d&q=zfs+reddit+send+incremental+encrypted https://www.google.com/search?client=firefox-b-1-d&q=zfs+red...