Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Currently, we can perform and encrypt a Windows backup with ntbackup and GPG in 2 separate steps in a batch script, as below:

ntbackup backup "@selection_file.bks" /f "backup_file.bak"
gpg --recipient "recipient" --encrypt "backup_file.bak" --output "encrypted_file" --yes --batch

I'm wondering if there's any way to combine these steps to output the backup directly to GPG, without creating an intermediate, unencrypted backup file?

To clarify, I'm looking for something like standard input redirection or piping

prog.exe | prog2.exe

that works with GPG at the command line. Thanks for your time.

share|improve this question
add comment

9 Answers

up vote 1 down vote accepted
+150

As Matt_Simmons so lucidly explained, ntbackup won't do output to stdout, so trying to use it is doomed.

gpg, however, will do the right thing if you use (unix convention) '-' as the file to input.

So now you need a way to gather files that includes 'the ability to easily select and exclude individual files', which tar totally fits the bill for (see the -T and -X flags). Modern versions will even do compression as well, via -z (gzip) and -j (bzip) flags.

And of course you can tie them together with a pipe:

tar -cjf - /dir/to/backup -X .mp3 | gpg --encrypt - --output "encrypted_backup.enc"
share|improve this answer
add comment

I don't think you'll be able to do that. But as an alternative you could probably backup to a mounted truecrypt volume.

share|improve this answer
    
Thanks, I suspect you're right. –  nedm May 28 '09 at 21:35
add comment

OK, here's why this isn't going to work.

What you're attempting to do is convince ntbackup to stream backup data to standard out instead of to a file. The problem is that ntbackup is not written to be able to do this. ntbackup must be given the filename to output the data to, and unfortunately in Windows, there is no equivalent to /dev/stdin or /dev/stdout.

In order for this to work, you would need to convince ntbackup to print the raw backup data to the screen. There is no documentation that I am aware of (or have found through searching) that even hints that this is remotely possible. It just wasn't written to do this. Sorry.

share|improve this answer
    
Thanks for the thorough explanation. Can you suggest an alternative that would let me stream to GPG? How about 7zip or one of the windows ports of tar (though I'd prefer compression)? The main advantage of ntbackup -- outside of shadow copy -- is the ability to easily select and exclude individual files and directories, but I'm certainly willing to work around this. –  nedm Jun 1 '09 at 15:29
add comment

Up for some programming? :) You can use a named pipe (aka fifo) to do this, but as far as I can tell, there's no batch-file ready interface.

share|improve this answer
    
wow. just reading that documentation makes me feel dirty ;-) –  Matt Simmons May 31 '09 at 11:36
    
Truly. I had a quick google but couldn't find any batch interface sadly. Surely someone has written some vbscript for this?! –  Alex Jurkiewicz May 31 '09 at 12:26
add comment

You could probably use a FIFO file to act as the pipe. Though I'm not exactly sure how you'd create one of these on windows. But that's generally what they're used for, where you can't use STDOUT to pipe to.

share|improve this answer
add comment

Performing a standard ntbackup and then using gpg does create an intermediate, unencrypted file. However, if you turn on EFS, you can put the backup file in an encrypted folder so that an attacker can't recover plaintext of the .bkf file. That's probably going to be the easiest way to accomplish what you're asking for without completely switching toolsets.

share|improve this answer
add comment

You can't do it with gpg but you can with openssl and mysys:

cat.exe testfile | openssl enc -cast > outfile

Here's the manpage, you can even specify a password on the command line if you really need to. This will only work with symmetric encryption.

share|improve this answer
add comment

The 7-Zip command line documention mentions -si and -so switches to read from stdin and write to stdout.

7z a dummy -tgzip -so Doc.txt > archive.gz

compresses Doc.txt file to output stream and writes that stream to archive.gz file.

It doesn't mention piping, but if you can write to stdout, I don't see why gpg wouldn't be able to read it in.

share|improve this answer
add comment

I don't believe that ntbackup supports any sort of encryption natively.

share|improve this answer
    
Right, which is why I was hoping that there was a clever batch file trick to redirect the output from ntbackup to GPG rather than a file. –  nedm May 28 '09 at 21:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.