Musings on ZFS Backup strategies
dweimer at dweimer.net
Fri Mar 1 20:09:50 UTC 2013
On 03/01/2013 1:25 pm, kpneal at pobox.com wrote:
> On Fri, Mar 01, 2013 at 09:45:32AM -0600, Karl Denninger wrote:
>> I rotate the disaster disks out to a safe-deposit box at the bank,
>> they're geli-encrypted, so if stolen they're worthless to the thief
>> (other than their cash value as a drive) and if the building goes
>> I have the ones in the vault to recover from. There's the potential
>> loss up to the rotation time of course but that is the same risk I
>> with all UFS filesystems.
> What do you do about geli keys? Encrypted backups aren't much use if
> you can't unencrypt them.
In my case I set them up with a pass-phrase only, I can mount them on
any FreeBSD system using geli attach ... then enter pass-phrase when
prompted. It is less secure than the key method (just because the
pass-phrase is far shorter than a key would be), but it ensures as long
as I can remember the pass-phrase I can access the data. However my
backups in this method are personal data, worse case scenario is someone
steals my identity, personal photos, and iTunes library. My bank
accounts don't have enough money in them to make it worth, someone going
through the time and effort to get the data off the disks. The
pass-phrase I picked uses all the good practices of mixed case, special
characters, and its not something easy to guess even by people who know
me well. It would be far easier to break into my house and get the data
that way, than break the encryption, on the external backup media.
If I was say backing up a corporate data with this method and my
company did defense research, well I would probably use both a
pass-phrase and key combination and store an offsite copy of the key in
a separate secure location from the media.
Dean E. Weimer
More information about the freebsd-stable