https:///index.php?action=history&feed=atom&title=Encrypted_backups 2026-04-07T09:24:32Z Revision history for this page on the wiki MediaWiki 1.35.1 2023-02-03T06:05:09Z

<p>Created page with &quot;=Backup strategy= The backup home for librti scripts and files is &#039;&#039;&#039;/opt/librti&#039;&#039;&#039;. &lt;br&gt;&lt;br&gt; The folder, file folder and all subdirectories should be owned by root:sudo. Th...&quot;</p> <p><b>New page</b></p><div>=Backup strategy=<br /> <br /> The backup home for librti scripts and files is &#039;&#039;&#039;/opt/librti&#039;&#039;&#039;. <br /> &lt;br&gt;&lt;br&gt;<br /> The folder, file folder and all subdirectories should be owned by root:sudo. This will allow all users to view and modify the files using appropriate sudo commands.<br /> &lt;br&gt;&lt;br&gt;<br /> Backups are done using tar and encrypted using gpg. A 32 bit passphrase is generated for each server.<br /> &lt;br&gt;&lt;Br&gt;<br /> On the server, generate the passphrase.<br /> $ openssl rand -hex 32 &gt; enc.key<br /> <br /> The command to encrypt files, and thus to be used in scripts, is thus<br /> &lt;pre&gt;<br /> #/bin/bash<br /> datum=`/bin/date +%Y%m%d-%H`<br /> ENCRYPTIONKEY=`cat /opt/librti/ssl/enc.key`<br /> tar czvpf - --exclude=&#039;^#&#039; --verbatim-files-from -T /opt/librti/filelist.txt | \<br /> gpg -c --batch --yes -z 0 --cipher-algo AES256 -o /opt/librti/backups/$HOSTNAME-${datum}.librti --passphrase-fd 9s 9&lt; &lt;(printf &#039;%s&#039; &quot;$ENCRYPTIONKEY&quot;) -<br /> &lt;/pre&gt;<br /> <br /> To decrypt<br /> $ gpg --batch --yes --passphrase &lt;phrase from enc.key&gt; -o outputfile.tar.gz -d inputfile.librti<br /> <br /> ==Connecting to Wasabi storage==<br /> $ sudo apt-get install s3cmd python3 python3-boto3<br /> After install, set up the connection.<br /> $ s3cmd --configure<br /> Enter in the access and secret key. When prompted for region<br /> us-east-1<br /> For the S3 endpoint<br /> s3.wasabisys.com<br /> Buckets are provisioned on the wasabi side (Roman did this first time). <br /> %(bucket)s.s3.wasabisys.com<br /> Provide an encryption key. Store it in the vault. The path to gpg should be default. Use HTTPS. Leave the proxy blank.<br /> &lt;br&gt;&lt;br&gt;<br /> Test the connection. It should work. <br /> ===View files on the s3 bucket===<br /> $ s3cmd la<br /> This will also tell us the bucket name.<br /> ===Send a file to the s3 storage===<br /> $ s3cmd put /path/to/file s3://&lt;bucket_name&gt;<br /> ===Recursively send all files in a folder ===<br /> $ s3cmd sync --acl-private --recursive --skip-existing --multipart-chunk-size-mb=256 /path/to/files/ s3://&lt;bucket-name&gt;</div>

Gr0x0rd