Questions about encryption

[Kaboom]

Dear all,

I made my backups encrypted with the option "Auto-generate a client encryption key, saved privately on cluster filesystem". But how can I browse this folder on the Proxmox backupserver?

And if I want to restore this backup to another node (not the node where the backup came from) is this possible, or do I need a key then?

Maybe someone can tell me something more about safely store these keys.

Thanks!

 

[fabian]

Dear all,

I made my backups encrypted with the option "Auto-generate a client encryption key, saved privately on cluster filesystem". But how can I browse this folder on the Proxmox backupserver?

you can't, since you need the key and that is not available on the server side. you can browse it using the client (mount/catalog shell for pxar, map + regular linux tools for block device backups).

And if I want to restore this backup to another node (not the node where the backup came from) is this possible, or do I need a key then?

you need the key

Maybe someone can tell me something more about safely store these keys.

There are a few ways (it might be a good idea to use more than one )

• if you have a lot of clients: generate (once) and import a master key (at each client), and apply the below points to the master key
• store the keyfile's contents in your password manager/HSM/...
• store the keyfile on some trusted/encrypted system other than where the backup client runs
• use the paperkey command to create a printable version of the keyfile, print it, and put it in your safe/firebox/bank vault/...

if you import a master key, the client will encrypt the encryption key using this master key, and put that encrypted copy into the backup itself. more info in the docs: https://pbs.proxmox.com/docs/backup...ster-key-to-store-and-recover-encryption-keys

 

[Kaboom]

Thanks Fabian, but I don't understand the part how I can browse the backup on the node (stored on the Proxmox backup server). Can you explain this a littlebit more?

 

[fabian]

proxmox-backup-client catalog shell or proxmox-backup-client mount for container backups, proxmox-backup-client map for VM backups. this part will get more integrated into PVE in the future.

 

[Kaboom]

I can create and restore backups threw the GUI now, everything encrypted.

On the Node where all my containers are running I run: 'proxmox-backup-client snapshots' and gives me a lists of all backups on the PBS.

Then I want to mount this backup: proxmox-backup-client mount ct/203/2020-12-01T03:08:50Z root.pxar /mnt/mountpoint
But I get this error: Error: missing key - manifest was created with key xx:xx:xx:xx:xx:xx:xx

I created all the keys automatically threw the GUI when creating a new storage.

What do I do wrong?

 

[fabian]

you need to pass the keyfile (the PVE generated ones are in /etc/pve/priv/storage/*.enc, but hopefully you DO have a backup copy of those somewhere? )

 

[Kaboom]

There are 2 files in the storage dir: xxx.enc en xxx.pw. I made backups during the setup of the storage.

Sorry but I don't know how to pass the keyfile.

 

[fabian]

add --keyfile /path/to/storage.enc to the command

 

[Kaboom]

Great, this did the trick!