<p dir="ltr">Yeah I recently set it up myself with unlimited cloud drive.</p>
<p dir="ltr">-Aaron</p>
<div class="gmail_quote">On Apr 15, 2016 8:35 PM, <<a href="mailto:gandalf@sonic.net">gandalf@sonic.net</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hey, thanks. This looks real good. I'll start digging into it next week. I have even found a elaborate setup script just for Amazon.<br>
<br>
On 2016-04-15 19:14, Aaron Grattafiori wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Checkout duplicity...<br>
On Apr 15, 2016 8:13 PM, <<a href="mailto:gandalf@sonic.net" target="_blank">gandalf@sonic.net</a>> wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Well I just got something working and am setting it up to work over<br>
the weekend.<br>
<br>
tar -zcf - -C /backups/servers itdocs | openssl enc -aes-256-cbc<br>
-salt -pass file:/etc/backups/key.bin | aws s3 cp -<br>
s3://XXXXXXX/servers/itdocs.160415.tar.gz.aes<br>
<br>
I was able to reverse the command and have it create a fresh itdocs<br>
folder full of goodies in a tmp folder. The key.bin file is 2048<br>
bytes of randomness:<br>
<br>
openssl rand -base64 2048 -out key.bin<br>
<br>
Is this any good? The sample I had only used 128 and I thought 2048<br>
would be better.<br>
<br>
I don't know how good this all is as backup encryption, but it<br>
looks like it should be as good as most. I'm not sure how it's going<br>
to handle the larger backups, but I guess I'll find out on Monday.<br>
It's set to do half Saturday morning and half Sunday morning.<br>
<br>
On 2016-04-15 18:46, Zack Zatkin-Gold wrote:<br>
I was about to say -- usually when you see malloc errors in a piece<br>
of<br>
software, it's because that software is unable to allocate more<br>
memory!<br>
<br>
On Fri, Apr 15, 2016 at 9:19 PM, <<a href="mailto:gandalf@sonic.net" target="_blank">gandalf@sonic.net</a>> wrote:<br>
I think I found the problem. The method works for large files but<br>
openssl<br>
loads the entire file into memory and hence it needs one gigabyte<br>
of memory<br>
available for every gigabyte of file. This method isn't going to<br>
work to<br>
encrypt a 500gig file and indeed breaks on my two gig test backup.<br>
<br>
Anybody have any suggestions for encrypting very large backup<br>
files?<br>
<br>
On 2016-04-15 15:41, <a href="mailto:gandalf@sonic.net" target="_blank">gandalf@sonic.net</a> wrote:<br>
<br>
I was looking for a way to encrypt files using a key or keys and<br>
found<br>
this article:<br>
<br>
<br>
</blockquote>
<a href="https://blog.altudov.com/2010/09/27/using-openssl-for-asymmetric-encryption-of-backups/#comment-399" rel="noreferrer" target="_blank">https://blog.altudov.com/2010/09/27/using-openssl-for-asymmetric-encryption-of-backups/#comment-399</a><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
[1]<br>
<br>
I tied it out and it worked, but oddly when I moved the keys to a<br>
different folder openssl said it couldn't find them. Of course I<br>
adjusted the encryption/description commands to point to the proper<br>
files. I moved them back to /root and suddenly they work.<br>
<br>
Here's the command the article says to use to create keys:<br>
openssl req -x509 -nodes -days 100000 -newkey rsa:2048 -keyout<br>
MyCompanyBackupsPRIVATE.pem -out MyCompanyBackupsPublicCert.pem<br>
-subj<br>
'/'<br>
<br>
Here's one of the errors I got:<br>
root@vault:/etc/backups/tmp# openssl smime -in<br>
itdocs.160415.tar.gz.aes -decrypt -binary -inform DEM -inkey<br>
../MSRI-Backups-PRIVATE.pem | tar -zx -f -<br>
Error reading S/MIME message<br>
139777656317600:error:07069041:memory buffer<br>
routines:BUF_MEM_grow_clean:malloc failure:buffer.c:159:<br>
139777656317600:error:0D06B041:asn1 encoding<br>
routines:ASN1_D2I_READ_BIO:malloc failure:a_d2i_fp.c:242:<br>
<br>
gzip: stdin: unexpected end of file<br>
tar: Child returned status 1<br>
tar: Error is not recoverable: exiting now<br>
<br>
Moved the pem files back to /root and everything works great.<br>
Although<br>
I find this reassuring I also find it disturbing as these keys are<br>
for<br>
encrypting backups and they may have to be manually typed in on a<br>
new<br>
system and used to restore an offsite backup from a disaster. I'd<br>
like<br>
to know that I can put these keys in folder and use them to decrypt<br>
backups.<br>
<br>
_______________________________________________<br>
talk mailing list<br>
<a href="mailto:talk@nblug.org" target="_blank">talk@nblug.org</a><br>
<a href="http://nblug.org/cgi-bin/mailman/listinfo/talk" rel="noreferrer" target="_blank">http://nblug.org/cgi-bin/mailman/listinfo/talk</a> [2]<br>
<br>
_______________________________________________<br>
talk mailing list<br>
<a href="mailto:talk@nblug.org" target="_blank">talk@nblug.org</a><br>
<a href="http://nblug.org/cgi-bin/mailman/listinfo/talk" rel="noreferrer" target="_blank">http://nblug.org/cgi-bin/mailman/listinfo/talk</a> [2]<br>
</blockquote>
_______________________________________________<br>
talk mailing list<br>
<a href="mailto:talk@nblug.org" target="_blank">talk@nblug.org</a><br>
<a href="http://nblug.org/cgi-bin/mailman/listinfo/talk" rel="noreferrer" target="_blank">http://nblug.org/cgi-bin/mailman/listinfo/talk</a> [2]<br>
<br>
<br>
Links:<br>
------<br>
[1]<br>
<a href="https://blog.altudov.com/2010/09/27/using-openssl-for-asymmetric-encryption-of-backups/#comment-399" rel="noreferrer" target="_blank">https://blog.altudov.com/2010/09/27/using-openssl-for-asymmetric-encryption-of-backups/#comment-399</a><br>
[2] <a href="http://nblug.org/cgi-bin/mailman/listinfo/talk" rel="noreferrer" target="_blank">http://nblug.org/cgi-bin/mailman/listinfo/talk</a><br>
<br>
_______________________________________________<br>
talk mailing list<br>
<a href="mailto:talk@nblug.org" target="_blank">talk@nblug.org</a><br>
<a href="http://nblug.org/cgi-bin/mailman/listinfo/talk" rel="noreferrer" target="_blank">http://nblug.org/cgi-bin/mailman/listinfo/talk</a><br>
</blockquote>
_______________________________________________<br>
talk mailing list<br>
<a href="mailto:talk@nblug.org" target="_blank">talk@nblug.org</a><br>
<a href="http://nblug.org/cgi-bin/mailman/listinfo/talk" rel="noreferrer" target="_blank">http://nblug.org/cgi-bin/mailman/listinfo/talk</a><br>
</blockquote></div>