Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revisionBoth sides next revision | ||
rethinking_my_backup_strategy [01.01.2021 22:12] – [self-made collection of other tools] Pascal Suter | rethinking_my_backup_strategy [01.01.2021 23:32] – [offsite backup file encryption] Pascal Suter | ||
---|---|---|---|
Line 73: | Line 73: | ||
* i have found [[https:// | * i have found [[https:// | ||
+ | ===== First POC - Burp + rsync ===== | ||
+ | with all the arguments above considered, I decided to proceed a burp based solution and just add off-site capabilities to burp. Here is the targeted setup: | ||
+ | * " | ||
+ | * '' | ||
+ | * '' | ||
+ | * '' | ||
+ | * one needs to make sure that all the necessary paths mentioned in '' | ||
+ | * " | ||
+ | * clients run the burp client and use client-side encryption with a strong password. the following additional core settings are used: | ||
+ | * '' | ||
+ | * '' | ||
+ | * a script on the burp server uses '' | ||
+ | * on the offsite server, a script is called (somehow, haven' | ||
+ | |||
+ | to try it all out i used a bunch of [[ubuntu test docker image | ubuntu test docker containers]] | ||
+ | |||
+ | docker network create burp | ||
+ | to create the custom network | ||
+ | docker run --net burp --name burpsrv -ti ubuntu-test: | ||
+ | to create the container for the burp server, and similar commands for the other servers. | ||
+ | |||
+ | for testing i ran the burp server with this command line: | ||
+ | burp -v -F -c / | ||
+ | |||
+ | which outputs any logs directly to stdout and keeps the daemon in the foreground. | ||
+ | |||
+ | ==== offsite backup file encryption ==== | ||
+ | since all files are encrypted on the client side before they are sent to the backup server, we don't have to encrypt them again when uploading them from the backup server to the offsite backup. this basically removes all the challenges mentioned in the "self made" backup solution above. | ||
+ | |||
+ | ==== restore from an offsite backup ==== | ||
+ | here is how i have tested the restore-ability of an offsite backup in case we have completely lost the backup server in between. | ||
+ | - set up a new burp backup server with the same client config | ||
+ | - setup a new client or delete the certificates if the client is still there and should be re-used | ||
+ | - using '' | ||
+ | - using '' | ||
+ | - now use '' | ||
+ | - restore using '' | ||
+ | |||
+ | this worked flawlessyl in my test, of coures as long as I still had the **encryption password** available from somewhere! .. needless to say, if you don't store your encryption password your backup is completely useless, so make sure your encryption password is saved somewhere where you will still have it, even if you loose the client, and of course, don't store it together with the backup on the backup servers :) | ||