Tape encryption keys + testing restore

[giovvv]

I am using PBS to backup to tape. I have enabled encryption.
Two questions:

1. I am not 100% sure that I have written down my password exactly. My backup server is still in good health, so I suppose I have the keys in /etc/proxmox-backup. Is there a way to retrieve the password, or at least to test it?

2. More generally, how can I test a restore from tape (without overwritting the original data in the process)? Is the right way to create a new empty datastore and then "proxmox-tape restore MEDIA-SET-UUID NEW-DATASTORE-NAME" ?

Thanks

 

[giovvv]

@dcsapak maybe?

 

[dcsapak]

Hi,

1. I am not 100% sure that I have written down my password exactly. My backup server is still in good health, so I suppose I have the keys in /etc/proxmox-backup. Is there a way to retrieve the password, or at least to test it?

no there is no way to restore the passphrase again. it also (currently) not possible with our tools to change the passphrase without the current passphrase.
you can test the passphrase by using 'proxmox-tape key change-passphrase'. this will first ask for the current passphrase (i opened a enhancement so that we could skip that: https://bugzilla.proxmox.com/show_bug.cgi?id=3853)

NOTE: If you change the passphrase for a key, it is NOT changed for existing tape backups, so if you're only left with old tape backups with a passphrase you don't know, there is no way to recover from it (assuming the pbs instance is lost)

I would really recommend using proper password management so that you cannot forget the passphrases, since in a disaster case, it may be your only chance to recover from backup (e.g. use a password manager)

2. More generally, how can I test a restore from tape (without overwritting the original data in the process)? Is the right way to create a new empty datastore and then "proxmox-tape restore MEDIA-SET-UUID NEW-DATASTORE-NAME" ?

yes that is one way, you can even only restore single snapshots from a media-set so you do not have to have a datastore big enough for the whole media-set (and it should not take as much time too)
note that if you restore only a single snapshot, that is the only thing read from tape, so there is no way to tell if the not tested snapshots are still good

 

[giovvv]

Thanks a lot Dominik.

you can test the passphrase by using 'proxmox-tape key change-passphrase'. this will first ask for the current passphrase (i opened a enhancement so that we could skip that: https://bugzilla.proxmox.com/show_bug.cgi?id=3853)

Thus the proposed --force argument means "from now on use this password – but be warned that the old tapes still use the old one". Ok.

By the way I noticed two little problems in the command:

1. The command currently asks for both the old and new password before checking the old one. This means that you cannot test a password without actually changing it (if the old matches, the new is applied). So to test a password without changing anything, you must enter it three times (old/new/verify). Not a big hassle really, but still no perfect UX either: I expected the command to verify the old one before doing anything else. But maybe there are technical reasons.

2. The command requires the "--hint" parameter, while the man page says it is optional. I opened bug #3856 on this.

 

[dcsapak]

Thus the proposed --force argument means "from now on use this password – but be warned that the old tapes still use the old one". Ok.

not exactly, the old tapes still use the old passphrase, so you'll not be able to recover the key from those if you lose the passphrase anyway
the '--force' would skip the input of the current passphrase

1. The command currently asks for both the old and new password before checking the old one. This means that you cannot test a password without actually changing it (if the old matches, the new is applied). So to test a password without changing anything, you must enter it three times (old/new/verify). Not a big hassle really, but still no perfect UX either: I expected the command to verify the old one before doing anything else. But maybe there are technical reasons.

mhmm... i can look at it, maybe a separate 'verify passphrase' would be good?

2. The command requires the "--hint" parameter, while the man page says it is optional. I opened bug #3856 on this.

thanks