News for hackers. Stuff that matters.

A comment on Cryptographic Right Answers. Parent comment

Re:Cryptographic Right Answers by rsync on Wednesday April 04, 2018 @01:39AM (#16752264)
"I've been waiting for something I can use to backup my workstation and laptops to a server at home as well as a server I have at $work (ISP)."

borg[1] has been referred to as "the holy grail of backups"[2] and is supported at rsync.net.[3]

The end result is encrypted, zero knowledge remote backups on a ZFS filesystem that you can SSH to.

I think everyone here knows all about rsync.net, but here are some examples:[4]

  ssh [email protected] sha256 some/file
  pg_dump -U postgres db | ssh [email protected] "dd of=db_dump"
  ssh [email protected] du -Ahd2 some/directory
[1] https://borgbackup.readthedocs.io/en/stable/

[2] https://www.stavros.io/posts/holy-grail-backups/

[3] http://rsync.net/products/attic.html

[4] http://www.rsync.net/resources/howto/remote_commands.html

[ Parent | on HN ]
Re:Cryptographic Right Answers by Freaky on Wednesday April 04, 2018 @11:27AM (#16755622)
One of the nicer bits of borg is the ability to restrict it to append-only mode, which limits the damage compromised hosts can do. e.g in authorized_keys:

    command="/usr/local/bin/borg serve --append-only --restrict-to-path=/home/backup/bla",restrict ...
I use this with passphrase-free ssh keys to allow automated backups without permitting the destruction of any existing backups.

Do you get enough control do to that on rsync.net?

[ Parent | on HN ]
Re:Cryptographic Right Answers by rsync on Wednesday April 04, 2018 @01:26PM (#16756910)
"Do you get enough control do to that on rsync.net?"

Yes. You have your own .ssh folder in your account and can edit (upload) your keys as you see fit.

Also, if you have our ZFS snapshots enabled, those are immutable/readonly - so even if you aren't using a sophisticated tool like borg, you still have snapshots of your data that are immune to attack - even from someone who knows all of your credentials.

[ Parent | on HN ]
Re:Cryptographic Right Answers by blattimwind on Tuesday April 10, 2018 @04:22AM (#16799879)
Borg's encryption scheme is weak and not suited for multiple nodes using the same repo.
[ Parent | on HN ]
Re:Cryptographic Right Answers by Wingwing on Wednesday April 04, 2018 @08:12AM (#16753958)
This isn't zero-knowledge. Please use this opportunity to educate the public instead of muddying the term for the sake of marketing buzzwords.
[ Parent | on HN ]
Re:Cryptographic Right Answers by CiPHPerCoder on Wednesday April 04, 2018 @12:29PM (#16756294)
To add to this comment: https://paragonie.com/blog/2016/08/crypto-misnomers-zero-kno...
[ Parent | on HN ]
Re:Cryptographic Right Answers by rsync on Wednesday April 04, 2018 @01:27PM (#16756919)
Your point is well taken. Thanks.
[ Parent | on HN ]