3 ms·
Current OpenZFS supports zfs send -w: "-w, -raw For encrypted datasets, send data exactly as it exists on disk. This allows backups to be taken even if encryp
by wumms 6y ago
Current OpenZFS supports zfs send -w:
"-w, -raw
For encrypted datasets, send data exactly as it exists on disk. This allows backups to be taken even if encryption keys are not currently loaded. The backup may then be received on an untrusted machine since that machine will not have the encryption keys to read the protected data or alter it without being detected. Upon being received, the dataset will have the same encryption keys as it did on the send side, although the keylocation property will be defaulted to prompt if not otherwise provided. For unencrypted datasets, this flag will be equivalent to -Lec Note that if you do not use this flag for sending encrypted datasets, data will be sent unencrypted and may be re-encrypted with a different encryption key on the receiving system, which will disable the ability to do a raw send to that system for incrementals."
Source: https://zfsonlinux.org/manpages/0.8.5/man8/zfs.8.html https://zfsonlinux.org/manpages/0.8.5/man8/zfs.8.html
- mavhc 6y agoThis would seem to make it the best backup system, you can merge your incremental backups over time, so never have to reset, without requiring any backup storage software on the remote computer, and it's never decrypted
- jonmon6691 6y agoI totally agree. I actually just built some scripts to do this using rclone, but they could easily be modified to work with a remote ZFS which is actually way more ideal. It is encrypted in-flight, and at rest on the remote, and merging block-level increments never require decryption. My key never has to leave my local machine. https://github.com/jonmon6691/storage_architecture https://github.com/jonmon6691/storage_architecture
- Fnoord 6y agoTools like Duplicati and Cryptomator also allow this. I'm using Jottacloud, 7,50 EUR for 5 TB (actually 'unlimited' but the speed gets slower after 5 TB). Rclone also has support for Jottacloud. Nice thing about Jottacloud is its hosted on Norway. They got privacy laws there. I know if you encrypt in-flight without having your private key remotely this is far less important, but still. Arguably, these products are therefore competitors.