proxmox-mirrors/pve-docs
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-docs synced 2025-04-30 18:39:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

pbs: add information about master key support

Browse Source 
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
This commit is contained in:
Fabian Grünbichler 2021-06-22 13:43:31 +02:00 committed by Thomas Lamprecht
parent b455993f50
commit 8200df48fb
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
pve-storage-pbs.adoc
View File

@ -57,6 +57,13 @@ restricted to the root user. Use the magic value `autogen` to automatically
generate a new one using `proxmox-backup-client key create --kdf none <path>`.
Optional.
master-pubkey::
A public RSA key used to encrypt the backup encryption key as part of the
backup task. The encrypted copy will be appended to the backup and stored on
the Proxmox Backup Server instance for recovery purposes.
Optional, requires `encryption-key`.
.Configuration Example (`/etc/pve/storage.cfg`)
----
pbs: backup
@ -116,6 +123,18 @@ a text file, for easy printing.
# proxmox-backup-client key paperkey /etc/pve/priv/storage/<STORAGE-ID>.enc --output-format text > qrkey.txt
----
Additionally, it is possible to use a single RSA master key pair for key
recovery purposes: configure all clients doing encrypted backups to use a
single public master key, and all subsequent encrypted backups will contain a
RSA-encrypted copy of the used AES encryption key. The corresponding private
master key allows recovering the AES key and decrypting the backup even if the
client system is no longer available.
WARNING: The same safe-keeping rules apply to the master key pair as to the
regular encryption keys. Without a copy of the private key recovery is not
possible! The `paperkey` command supports generating paper copies of private
master keys for storage in a safe, physical location.
Because the encryption is managed on the client side, you can use the same
datastore on the server for unencrypted backups and encrypted backups, even
if they are encrypted with different keys. However, deduplication between