Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using duplicity to perform backups on my server. Right now duplicity is encrypting the backup using a GPG public-private key system. I would prefer to encrypt the backup files using just a passphrase, so I don't have to try and keep up with secret keys. How can I configure the backups to be encrypted this way?

Thanks,

Mike

share|improve this question

2 Answers 2

up vote 3 down vote accepted

The default mode of duplicity is to use a symmetric key which consists of a simple passphrase. There's no way I would use that though: if you have to type the key, you can't run an unattended backup!

If you want to run an unattended backup, you have to pass duplicity a public key somehow. The only kind of public key that duplicity supports is GPG, and that requires a key pair. If you don't want more security than the passphrase provides, keep plenty of copies of the private key around (e.g. store it on every backup media, and print it).

Note that you need to choose a really good passphrase (as in long and having high entropy) to get reasonable security from offline attacks (which is the threat here).

share|improve this answer
    
Gilles, So you're telling me that I am already using symmetric encryption? Does this mean that if my server was to explode today, I could restore my backups just using the passphrase? I was under the impression that the passphrase had to be somehow used in conjunction with some key stored in my gpg db, meaning I would have to protect my GPG DB with my life! I am able to use a passphrase in an unattended backup by exporting the phrase to $PASSPHRASE at the beginning of my backup script, then unsetting it at the end. –  Mike C Aug 25 '10 at 4:10
    
@Mike: As far as I remember, duplicity only supports the two modes. If you're passing --encrypt-key, you're using public key encryption, and your private key is composed from your private key file and your passphrase. Otherwise you're using symmetric encryption and the secret key consists of your passphrase exclusively. Obviously, you should test restoring on a machine or account that doesn't have your gpg database, if that's what you want. –  Gilles Aug 25 '10 at 7:07
    
I'm going to do a test restore tonight on a separate machine to see what happens, thanks! –  Mike C Aug 25 '10 at 13:24

old question, but I have an answer. You can set the passphrase in your backupscript, to let it run unattended.

#!/bin/bash
export PASSPHRASE=<your password>
duplicity…
share|improve this answer
    
Don't forget unset PASSPHRASE at the end of the script, otherwise the passphrase will be available to other scripts. –  Sam Jan 28 at 0:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.