Linux LTO-4/5/6 Hardware AES Drive Encryption

Question

For a number of reasons I have been trying to find a way to encrypt my backup tapes. I'm currently running Bacula for my backups and it's support for Drive based encryption is I have to call a script or something to set the key in the drive.

How can I set the encryption options on the tape drive in Debian Linux?

Answer 1

stenc project should be useful (haven't personally tested that) -- http://sourceforge.net/projects/stenc/

Answer 2

I have tested stenc as suggested by sendmoreinfo and it worked well with the LTO-6 drive.

Usage:

Insert a tape and ask the tape drive about its settings:

# stenc -f /dev/nst0 --detail

Generate your 256 bit key and store it:

# stenc -g 256 -k /root/myaes.key -kd Bobs_month_key

Load the key in the LTO tape drive. With --ckod it will forget the key after tape eject.

# stenc -f /dev/nst0 -e on -k /root/myaes.key -a 1 --ckod

Verify that the drive enabled AES now:

# stenc -f /dev/nst0 --detail
Status for /dev/nst0
--------------------------------------------------
Device Mfg:              TANDBERG
Product ID:              LTO-6 HH        
Product Revision:        3519
Drive Encryption:        on
Drive Output:            Decrypting
                         Unencrypted data not outputted
Drive Input:             Encrypting
                         Protecting from raw read
Key Instance Counter:    4
Encryption Algorithm:    1
Drive Key Desc.(uKAD):   Bobs_month_key
Volume Encryption:       Encrypted and able to decrypt
                         Protected from raw read
Volume Algorithm:        1

I have prepared a package for Gentoo Linux.