X-Git-Url: https://git.proxmox.com/?a=blobdiff_plain;f=pve-storage-pbs.adoc;h=a3d7da18347174b161291750bac4167f619d5bd8;hb=151bbda876579c0df1a3c598e17a9e43e9ff82b6;hp=9527237f7b35b314f069f6a39a1495c92904ab6f;hpb=921926036a9bb3824833ca705e68a45a66f38f09;p=pve-docs.git diff --git a/pve-storage-pbs.adoc b/pve-storage-pbs.adoc index 9527237..a3d7da1 100644 --- a/pve-storage-pbs.adoc +++ b/pve-storage-pbs.adoc @@ -57,6 +57,13 @@ restricted to the root user. Use the magic value `autogen` to automatically generate a new one using `proxmox-backup-client key create --kdf none `. Optional. +master-pubkey:: + +A public RSA key used to encrypt the backup encryption key as part of the +backup task. The encrypted copy will be appended to the backup and stored on +the Proxmox Backup Server instance for recovery purposes. +Optional, requires `encryption-key`. + .Configuration Example (`/etc/pve/storage.cfg`) ---- pbs: backup @@ -82,8 +89,64 @@ container. |backup |n/a |yes |n/a |n/a |=============================================================== -Examples -~~~~~~~~ +[[storage_pbs_encryption]] +Encryption +~~~~~~~~~~ + +[thumbnail="screenshot/storage-pbs-encryption-with-key.png"] + +Optionally, you can configure client-side encryption with AES-256 in GCM mode. +Encryption can be configured either via the web interface, or on the CLI with +the `encryption-key` option (see above). The key will be saved in the file +`/etc/pve/priv/storage/.enc`, which is only accessible by the root +user. + +WARNING: Without their key, backups will be inaccessible. Thus, you should +keep keys ordered and in a place that is separate from the contents being +backed up. It can happen, for example, that you back up an entire system, using +a key on that system. If the system then becomes inaccessible for any reason +and needs to be restored, this will not be possible as the encryption key will be +lost along with the broken system. + +It is recommended that you keep your key safe, but easily accessible, in +order for quick disaster recovery. For this reason, the best place to store it +is in your password manager, where it is immediately recoverable. As a backup to +this, you should also save the key to a USB drive and store that in a secure +place. This way, it is detached from any system, but is still easy to recover +from, in case of emergency. Finally, in preparation for the worst case scenario, +you should also consider keeping a paper copy of your key locked away in a safe +place. The `paperkey` subcommand can be used to create a QR encoded version of +your key. The following command sends the output of the `paperkey` command to +a text file, for easy printing. + +---- +# proxmox-backup-client key paperkey /etc/pve/priv/storage/.enc --output-format text > qrkey.txt +---- + +Additionally, it is possible to use a single RSA master key pair for key +recovery purposes: configure all clients doing encrypted backups to use a +single public master key, and all subsequent encrypted backups will contain a +RSA-encrypted copy of the used AES encryption key. The corresponding private +master key allows recovering the AES key and decrypting the backup even if the +client system is no longer available. + +WARNING: The same safe-keeping rules apply to the master key pair as to the +regular encryption keys. Without a copy of the private key recovery is not +possible! The `paperkey` command supports generating paper copies of private +master keys for storage in a safe, physical location. + +Because the encryption is managed on the client side, you can use the same +datastore on the server for unencrypted backups and encrypted backups, even +if they are encrypted with different keys. However, deduplication between +backups with different keys is not possible, so it is often better to create +separate datastores. + +NOTE: Do not use encryption if there is no benefit from it, for example, when +you are running the server locally in a trusted network. It is always easier to +recover from unencrypted backups. + +Example: Add Storage over CLI +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ // TODO: FIXME: add once available //You can get a list of exported CIFS shares with: