Why are my synced encrypted backups not encrypted???????????

[proxwolfe]

So I have a local PBS running, backing up my PVE cluster. Backups are encrypted.

And I have another PBS running offsite, syncing the backups from my local PBS for safekeeping. The same backups are not encrypted at the other PBS.

Why?

What do I need to do to keep my encrypted backups the way I like them: encrypted???

Thanks!

 

[aaron]

Do I understand it correctly? You have something like this?

Client (PVE?), encrypting backups -> PBS1 -> PBS2

And the backups are shown as encrypted on PBS1 but not PBS2?

 

[proxwolfe]

Yes, exactly.

Did I miss a setting somewhere to keep the backups encrypted when synced?

 

[fabian]

sync cannot change the encryption state at all, it doesn't even have code to handle encryption keys.. please check your task logs to find out where the unencrypted backups are coming from, either you are doing backups directly to PBS2, or you have unencrypted backups on PBS1 (maybe in a forgotten namespace?) that are the actual source..

 

[wbk]

have unencrypted backups on PBS1

How could I verify that my chunks are encrypted data, or prove that they are not?

I tried strings on a couple of chunks, but did not get any readable results. My backups are unencrypted.

 

[RolandK]

can we have a screenshot that shows the encrypted and unencrypted backup group/snapshot including name and timestamp ?

 

[fabian]

How could I verify that my chunks are encrypted data, or prove that they are not?

I tried strings on a couple of chunks, but did not get any readable results. My backups are unencrypted.

the chunks start with a magic value:

https://git.proxmox.com/?p=proxmox-...67e20a6ece95f95434ff8053aa8307ced6f80;hb=HEAD

but on a higher level, PBS tells you whether a snapshot (and thus, all chunks referenced by that snapshot) is encrypted or not when displaying the datastore contents.