Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I realize some form of this question has been asked many times before but none of the answers I've seen are really what I'm looking for.

I have a server that I'll call S and a backup machine that I'll call B. Right now, S has whole disk encryption and B has no encryption. Since the encryption on S only matters when the machine is powered off, all the files that B gets when it rsyncs into S are unencrypted. Thus, my backups are not encrypted.

Since B is a Netgear ReadyNAS Pro and, according to the people at the ReadyNAS forums, the ReadyNAS can't easily be encrypted, I'm looking for some way to encrypt my data before it gets to the ReadyNAS.

Surely this kind of thing has been done by many people many times before. Rather than only recommending a certain product like Duplicity or ZMANDA, could someone please explain to me the theory behind this? For example, is it ideal to copy the data to the backup disk, then encrypt the disk, or is it better to encrypt the data, then copy it to the backup disk? Please don't just throw a product at me. I'm looking for the "how", not the "what".

share|improve this question
up vote 4 down vote accepted

You already understand the theory: you stated it in your question.
Encrypt the data before you send it over the network, and don't decrypt it until after it comes back onto a secure machine authorized to have it.

Because your ReadyNAS device can't be easily encrypted you're left with encrypting the backup itself (as opposed to the disk it's being copied to), and honestly that's a better solution in my opinion: It protects you in the event your backup machine gets compromised while running, and it means you can keep the decryption key offline somewhere so there's less chance of a data thief getting their hands on it.

share|improve this answer
Okay, thanks. Now, so I know what question to ask next, how might I go about encrypting the data before I send it? My current whole disk encryption is orthogonal to the problem. Is there some way to "rsync encryptedly"? – Jason Swett Oct 25 '10 at 19:31
@Jason_Swett - rsync already encrypts files in transit; look into gpg ( or bcrypt ( to encrypt files before they are transferred – danlefree Oct 25 '10 at 20:27

I would always rather encrypt the data and then back it up, since it will then be encrypted in transit and at rest. Where this could become a problem is if server S doesn't have the proc to do the encryption and it's normal processes, but this normally isn't a problem with server now a days. There are a lot of programs that would do encrypted backups for you, or you can use various tools like openssl and scp to encrypt data then secure copy it to another location.

share|improve this answer
+1 for "encrypt before you send". – voretaq7 Oct 25 '10 at 19:24
  • Here is a basic backup command, which causes duplicity to use scp/ssh to back up /home/me on the local system to /usr/backup on remote host

    duplicity /home/me scp://

  • If the above command is run repeatedly, the first session will be a full backup, and subsequent ones will be incremental.

  • Basic restore command---restore the /home/me directory backed up with scp above to directory restored_dir:-

    duplicity scp:// restored_dir

From the Documentation for Duplicity.

From your description, you would run the above command on S and if B's drives are mounted on S use file://mount/path/name instead of scp://uid@B. Similarly, if B supports FTP or an rsync daemon, there are URL prefixes you can use instead.

share|improve this answer
Note that this only addresses channel encryption -- The data is still stored in an unencrypted form when it lands on the remote machine. You would need to follow the additional steps @ (e.g.)… to have the data remain encrypted on the remote machine. – voretaq7 Oct 25 '10 at 19:23
I based my answer on this material from the Duplicity website: "Duplicity backs directories by producing encrypted tar-format volumes and uploading them to a remote or local file server ... Because duplicity uses GnuPG to encrypt and/or sign these archives, they will be safe from spying and/or modification by the server." - but I believe voretaq7 is correct. – RedGrittyBrick Oct 25 '10 at 19:25

If you tell us how you're currently doing that backup, we can tell you how to do it using your existing tools.

For example, DAR supports encrypted backups quite nicely. Just throw a password into the command and away you go.

share|improve this answer
I'm backing up via rsync and it's the ReadyNAS that's running the rsync command. (The ReadyNAS only supports a few different methods and rsync is one of them. I don't believe DAR is.) – Jason Swett Oct 25 '10 at 19:36
Yeah. In order to encrypt your backups, you will need to push the data from your server, rather than pulling it with the NAS. A cron job using DAR to do incrementals would be a pretty good way to set it up. – Paul McMillan Oct 25 '10 at 19:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.