View previous topic :: View next topic |
Author |
Message |
LIsLinuxIsSogood Veteran

Joined: 13 Feb 2016 Posts: 1175
|
Posted: Sun Dec 01, 2019 7:26 pm Post subject: Backing up encrypted disk partition |
|
|
I have some encrypted disk partitions on other linux operating systems using luks/dm-crypt that I would like to know how I can backup on my local gentoo box, but I don't want to encrypt my entire Gentoo disk as it would be a lot of work to do that. So far, I have wiped a 1TB space on a backup drive. I am at the stage of being ready to proceed with creating the encrypted file system. I am primarily interested in trying to have this:
1. Backing up should open/unlock the partition for writing and write to it
2. Recovering backups need to open it for reading as well.
3. Possibly some NFS sharing of the drive once it is open in order to view and interact with the backup files in their locations on the encrypted disk.
So in terms of having the partition be "locked" or ecnrypted most of the time, and then opened at times or closed at times, also because I am backing up from dm-crypt does it make sense to also backup TO dm-crypt or does that not really matter?
What is easiest to setup? That's what I want to try.[/topic] |
|
Back to top |
|
 |
Hu Moderator

Joined: 06 Mar 2007 Posts: 16460
|
Posted: Sun Dec 01, 2019 8:41 pm Post subject: |
|
|
The easiest would be to leave the encrypted volumes open all the time, and then treat them like regular filesystems. You probably don't want that. Second easiest would be to have the backup process open the drive beforehand, and close it afterward. Whether it makes sense to encrypt the backup depends on why you encrypt the primary data drive. Is the primary encrypted because:- It contains data you are contractually obligated to encrypt at rest? If yes, the contract probably requires you to keep all backups at least as secure as the primary.
- You want to prevent others who have hardware access from manipulating the data on the primary? If yes, you might instead arrange that those people have no physical access to the backups, after which it doesn't matter if you encrypt the backups.
- You are defending against a future loss of physical control of the device to theft or to RMA. If yes, then ask whether the backup is also at risk of such future loss of control. If it is, then encrypt it too.
|
|
Back to top |
|
 |
pa4wdh Guru

Joined: 16 Dec 2005 Posts: 417
|
Posted: Mon Dec 02, 2019 3:48 pm Post subject: Re: Backing up encrypted disk partition |
|
|
I'm not sure if i fully understand your question, so please correct me if my answer doesn't fit your question.
The way I backup my partitions (encrypted or not) is to tar/gz them onto an external drive which itself is encrypted with dmcrypt. When not in use the disk is not connected to any system, it is only connected when i make or restore backups.
LIsLinuxIsSogood wrote: |
So in terms of having the partition be "locked" or ecnrypted most of the time, and then opened at times or closed at times, also because I am backing up from dm-crypt does it make sense to also backup TO dm-crypt or does that not really matter?
|
Assuming you had a valid reason to encrypt this data in the first place it makes sense to back them up to an encrypted disk too. If you backup data from an encrypted disk to an unencrypted one you basically lose the encryption and the protection that comes with it. A possible alternative is to use tar/gz and pipe it trough gpg to encrypt the backups themselves, but be aware that his is a bit more of a hassle to set up and gives you the dilemma of backup op the key(s) for your backup  _________________ The gentoo way of bringing peace to the world:
USE="-war" emerge --newuse @world
Free as in Freedom is not limited to software only:
Music: http://www.jamendo.com
Recipes: http://www.opensourcefood.com |
|
Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
|