4 ms·

I am the author of bupstash - https://github.com/andrewchambers/bupstash https://github.com/andrewchambers/bupstash which has many advantages over borg in my bi

I am the author of bupstash - https://github.com/andrewchambers/bupstash https://github.com/andrewchambers/bupstash which has many advantages over borg in my biased opinion (like air gapped decryption keys and better performance). Feel free to check it out.

g_p 4y ago
Thanks for your work on bupstash. To second this, there are some threat models that are often overlooked with backups. Separating the encryption and restore keys makes sense, and is a design pattern few of the modern new backup tools offer - bupstash and duplicacy are the two that spring to mind which support asymmetrically encrypted backups. The recent lastpass issue shows the importance of keeping the backup decryption keys offline and inaccessible. A headless server with backup script can upload backups, but if someone can access the script and backups, they have the golden goose (users' vaults). Most other backup tools don't give you the ability to separate out creating and retrieving backups. Separate moan - very few of the backup tools that use s3 style buckets give a proper description of the IAM security model you should use - I like to understand what object prefixes are used, and what the absolute minimum I require is, as I like to start from minimum privilege - PutObject, GetObject on an index or config file, and nothing else if I can avoid it! Hopefully we see more focus on backup security after lastpass.
dvzk 4y ago
I was about to mention this. It’s hard for me to take any symmetric or password-based backup tools seriously. User chosen passwords are a disaster for offline encryption. Most tools also use related key input for (non-)authenticated encryption and decryption. A server shouldn’t be able to decrypt backups and authentically encrypt new backups.
arde 4y ago
Very interesting, I like its design better. Could you comment on whether bupstash supports ACLs (POSIX, xattr, etc.)? According to issue #25 it does, but I couldn't find documentation on how to exclude it when restoring, viewing it, etc.
- andrewchambers 4y ago
  The default is to exclude them, but commands like get/restore/put take options to enable xattr support. The reason for ignoring them by default is simply pragmatic - fewer syscalls while walking the filesystem.
rdslw 4y ago
does bupstash has 'append-only' mode, or to put it differently: how can I achieve sth similar (ability to do backups, but not to meddle with previous ones) with bupstash features (roles/diff keys etc) ?
- andrewchambers 4y ago
  Yes it does - via ssh force commands. In the hosted version you just tick a checkbox in the web ui for each ssh key.

g_p 4y ago

Thanks for your work on bupstash. To second this, there are some threat models that are often overlooked with backups. Separating the encryption and restore keys makes sense, and is a design pattern few of the modern new backup tools offer - bupstash and duplicacy are the two that spring to mind which support asymmetrically encrypted backups. The recent lastpass issue shows the importance of keeping the backup decryption keys offline and inaccessible. A headless server with backup script can upload backups, but if someone can access the script and backups, they have the golden goose (users' vaults). Most other backup tools don't give you the ability to separate out creating and retrieving backups. Separate moan - very few of the backup tools that use s3 style buckets give a proper description of the IAM security model you should use - I like to understand what object prefixes are used, and what the absolute minimum I require is, as I like to start from minimum privilege - PutObject, GetObject on an index or config file, and nothing else if I can avoid it! Hopefully we see more focus on backup security after lastpass.

dvzk 4y ago

I was about to mention this. It’s hard for me to take any symmetric or password-based backup tools seriously. User chosen passwords are a disaster for offline encryption. Most tools also use related key input for (non-)authenticated encryption and decryption. A server shouldn’t be able to decrypt backups and authentically encrypt new backups.

arde 4y ago

Very interesting, I like its design better. Could you comment on whether bupstash supports ACLs (POSIX, xattr, etc.)? According to issue #25 it does, but I couldn't find documentation on how to exclude it when restoring, viewing it, etc.

andrewchambers 4y ago
The default is to exclude them, but commands like get/restore/put take options to enable xattr support. The reason for ignoring them by default is simply pragmatic - fewer syscalls while walking the filesystem.

rdslw 4y ago

does bupstash has 'append-only' mode, or to put it differently: how can I achieve sth similar (ability to do backups, but not to meddle with previous ones) with bupstash features (roles/diff keys etc) ?

andrewchambers 4y ago
Yes it does - via ssh force commands. In the hosted version you just tick a checkbox in the web ui for each ssh key.