Clarification of keyfile backup #6207
Conversation
Proposed clarification in response to my confusion in borgbackup#6204.
| If you use keyfile encryption, you MUST make sure to have an independent backup of these keyfiles, otherwise you cannot access your backups anymore if you lose | ||
| them. If you use repokey encryption it is also highly recommended that you backup the keyfiles in case the originals (stored within the repository) get damaged. The best way to create a backup is using the ``borg key export`` command. |
There was a problem hiding this comment.
Thinking about this: can't we just simply say that you must have a backup of the keys in any case and use borg key export for this?
In the end, it doesn't really matter where they are stored and how you lose them, but that for both options, it is possible to lose them.
There was a problem hiding this comment.
True, something like "backup the key in case you need it" is probably the shortest version for the end user.
My confusion really came from the fact that this said disaster recovery without a backup of the keyfile was impossible but I did remember doing just that last year (which was possible because I had repokey and not keyfile enc).
There was a problem hiding this comment.
Or: By all means, backup the key! And keep the backup and your passphrase at a safe place.
|
Hmm, I just noticed we should document that elsewhere: In the Currently, we have 2 places talking about key backup:
I think both places should only have one sentence about that where they link to And everything else should get refactored and deduplicated into the |
| borg repokey keys are stored inside the repository. You MUST make sure to have an | ||
| independent backup of these keyfiles, otherwise you cannot access your backups anymore if you lose | ||
| them. You also MUST keep these files secret; everyone who gains access to your repository and has | ||
| All your borg keyfile keys are stored in this directory. Please note that borg repokey keys are stored inside the repository. |
There was a problem hiding this comment.
"keyfile keys" sound somewhat weird, I'd say they are just "keyfiles".
Also, the first part of this basically just reformarts into a single awfully long line. The file already has some variation in line lengths, but that should not be worsened.
There was a problem hiding this comment.
well, agreed, it sounds a bit strange, but the types of borg keys we have are "keyfile" and "repokey".
so while it may sound a bit strange, it hopefully makes 100% clear what is meant.
Proposed clarification in response to my confusion in #6204.