<html><head></head><body><div>I'm not 100% certain but I think bacula can do a pull with encrypted storage.</div><div><br></div><div>My understanding is the manager says "back it up now" and the fd (file daemon) proceeds to check what needs to be updated by comparing modified dates with the last backup time.</div><div><br></div><div>Now the FD uses it's key to encrypt the file to be backed up and sends the encrypted stream to the SD plus the metadata to Dir for parking on media and database.</div><div><br></div><div>There's also the way to simply encrypt all files at the storage end but that way the receiving SD can "see" the file content.</div><div><br></div><div>On Tue, 2016-02-16 at 11:52 -0500, Derek Atkins wrote:</div><blockquote type="cite"><pre>Hi,
On Tue, February 16, 2016 11:01 am, DJ-Pfulio wrote:
<blockquote type="cite">
On 02/16/2016 10:23 AM, Derek Atkins wrote:
<blockquote type="cite">
DJ-Pfulio <<a href="mailto:djpfulio@jdpfu.com">djpfulio@jdpfu.com</a>> writes:
<blockquote type="cite">
Best, easier, how-to:
<a href="https://www.kirya.net/articles/backups-using-rdiff-backup/">https://www.kirya.net/articles/backups-using-rdiff-backup/</a> Use the
"pull" method for greater security.
</blockquote>
Only concern with rdiff-backup is the inability to encrypt the backups
(Data at Rest encryption).
</blockquote>
Excellent point. encfs solves it. Small tools that do one job well?
Sure, it
is another step and some people don't like more steps. Nothing wrong with
that
at all, provided it all works correctly.
</blockquote>
Well, it does mean it's no longer a "pull" method; I would need to convert
this to a "push" model in order to "push" the backup through encfs. I
suppose I could do this by having a dedicated backup server that is
different than the backup storage. It could use something like NFS (wth
encfs layered over it) to the storage server, and then it could
rdiff-backup "pull" from the target servers and store it into the
encfs/NFS storage.
Considering my storage server is FreeNAS, I dont think I can use it as the
rdiff-backup pull server.
I wonder how much RAM/CPU would be required for this? I wonder if I could
use a low-power ARM board?
<blockquote type="cite">
I thought that most enterprise tape drives had HW encryption built in?
</blockquote>
I'm not using tape, myself, so this is mostly irrelevant.
<blockquote type="cite">
We're all looking for "the best" backup tool for our personal values of
"the
best." The search continues?
</blockquote>
Yep. It does.
-derek
</pre></blockquote></body></html>