Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Currently, I use tar to write my backups (ntbackup files) to a tape drive fed by an autoloader.

Ex: tar -F /root/advancetape -cvf /dev/st0 *.bkf (/root/advancetape just has the logic to advance to the next tape if there is one available or notify to swap the tapes out)

I was recently handed the requirement to encrypt our tape backups. I can easily encrypt the data with no problems using GPG. The problem I'm having is how do I write this to multiple tapes with the same logic that tar uses to advance the tapes once the current one is filled? I cannot write the encrypted file to disk first (2+TB). As far as I can tell, tar will not accept binary input from stdin (it's looking for file names). Any ideas? :(

share|improve this question
    
Encryption is easy. Key management is not. Make sure you've figured that out before you start. –  duffbeer703 Oct 26 '09 at 20:28
    
If it is so easy, would you mind sharing a solution to the above problem? :-) –  Dan Oct 26 '09 at 21:09
    
What type of Tape drive? I ask because LTO4 drives have built in hardware encryption –  Zypher Dec 15 '09 at 4:44
    
IBM LTO2 :( We may be purchasing a new drive with hardware encryption soon to backup our new storage array... would still be nice to know how to get this done though. –  Dan Jan 25 '10 at 16:49
    
Why not just run the bkf files through encryption before writing them to tape? –  Chris S Aug 16 '10 at 18:26

2 Answers 2

You could potentially implement this in your -F script. Instead of having tar write directly to /dev/st0, use a temporary staging area. Make sure you specify volume size explicitly using -L . Tar will write up to bytes of data to the file and then call your -F script. Your script could then run gpg on the file and send it to tape (and then delete the archive part from your staging area).

This only requires that you have one tape's worth (x2) of space available on your filesystem.

See http://www.gnu.org/software/tar/manual/html_node/Multi_002dVolume-Archives.html#SEC162 for more information on variables available to your -F script.

EDIT: Also note that this is a completely untested idea! I've been thinking of doing something like this in order to provide compression to multivolume archives, but I haven't actually implemented it.

share|improve this answer

I would suggest you look at this option:

 -I, --use-compress-program PROG
       filter through PROG (must accept -d)

You might need to write a script that takes the input from stdin and encrypts it to stdout, but it should work. The -d is for decompression, in which case you'd need to unencrypt the input.

share|improve this answer
    
Almost... but.. :( # tar -F /root/advancetape --use-compress-program=aespipe -cvf /dev/st0 /mnt/array/ tar: Cannot use multi-volume compressed archives Try tar --help' or tar --usage' for more information. –  Dan Oct 26 '09 at 21:07
    
Bah, so near, yet so far. It looked so promising too. –  David Pashley Oct 26 '09 at 21:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.