Musings on ZFS Backup strategies

[dweimer]

On 03/01/2013 1:25 pm, kpneal at pobox.com wrote:
> On Fri, Mar 01, 2013 at 09:45:32AM -0600, Karl Denninger wrote:
>> I rotate the disaster disks out to a safe-deposit box at the bank, 
>> and
>> they're geli-encrypted, so if stolen they're worthless to the thief
>> (other than their cash value as a drive) and if the building goes 
>> "poof"
>> I have the ones in the vault to recover from.  There's the potential 
>> for
>> loss up to the rotation time of course but that is the same risk I 
>> had
>> with all UFS filesystems.
> What do you do about geli keys? Encrypted backups aren't much use if
> you can't unencrypt them.

In my case I set them up with a pass-phrase only, I can mount them on 
any FreeBSD system using geli attach ... then enter pass-phrase when 
prompted. It is less secure than the key method (just because the 
pass-phrase is far shorter than a key would be), but it ensures as long 
as I can remember the pass-phrase I can access the data.  However my 
backups in this method are personal data, worse case scenario is someone 
steals my identity, personal photos, and iTunes library.  My bank 
accounts don't have enough money in them to make it worth, someone going 
through the time and effort to get the data off the disks.  The 
pass-phrase I picked uses all the good practices of mixed case, special 
characters, and its not something easy to guess even by people who know 
me well.  It would be far easier to break into my house and get the data 
that way, than break the encryption, on the external backup media.
If I was say backing up a corporate data with this method and my 
company did defense research, well I would probably use both a 
pass-phrase and key combination and store an offsite copy of the key in 
a separate secure location from the media.

-- 
Thanks,
    Dean E. Weimer
    http://www.dweimer.net/