2 \chapter{Data Encryption}
4 \index[general]{Data Encryption}
5 \index[general]{Encryption!Data}
6 \index[general]{Data Encryption}
8 Bacula permits file data encryption and signing within the File Daemon (or
9 Client) prior to sending data to the Storage Daemon. Upon restoration,
10 file signatures are validated and any mismatches are reported. At no time
11 does the Director or the Storage Daemon have access to unencrypted file
15 It is very important to specify what this implementation does NOT
18 \item There is one important restore problem to be aware of, namely, it's
19 possible for the director to restore new keys or a Bacula configuration
20 file to the client, and thus force later backups to be made with a
21 compromised key and/or with no encryption at all. You can avoid this by
22 not not changing the location of the keys in your Bacula File daemon
23 configuration file, and not changing your File daemon keys. If you do
24 change either one, you must ensure that no restore is done that restores
25 the old configuration or the old keys. In general, the worst effect of
26 this will be that you can no longer connect the File daemon.
28 \item The implementation does not encrypt file metadata such as file path
29 names, permissions, and ownership. Extended attributes are also currently
30 not encrypted. However, Mac OS X resource forks are encrypted.
33 Encryption and signing are implemented using RSA private keys coupled with
34 self-signed x509 public certificates. This is also sometimes known as PKI
35 or Public Key Infrastructure.
37 Each File Daemon should be given its own unique private/public key pair.
38 In addition to this key pair, any number of "Master Keys" may be specified
39 -- these are key pairs that may be used to decrypt any backups should the
40 File Daemon key be lost. Only the Master Key's public certificate should
41 be made available to the File Daemon. Under no circumstances should the
42 Master Private Key be shared or stored on the Client machine.
44 The Master Keys should be backed up to a secure location, such as a CD
45 placed in a in a fire-proof safe or bank safety deposit box. The Master
46 Keys should never be kept on the same machine as the Storage Daemon or
47 Director if you are worried about an unauthorized party compromising either
48 machine and accessing your encrypted backups.
50 While less critical than the Master Keys, File Daemon Keys are also a prime
51 candidate for off-site backups; burn the key pair to a CD and send the CD
52 home with the owner of the machine.
54 NOTE!!! If you lose your encryption keys, backups will be unrecoverable.
55 {\bf ALWAYS} store a copy of your master keys in a secure, off-site location.
57 The basic algorithm used for each backup session (Job) is:
59 \item The File daemon generates a session key.
60 \item The FD encrypts that session key via PKE for all recipients (the file
61 daemon, any master keys).
62 \item The FD uses that session key to perform symmetric encryption on the data.
66 \section{Building Bacula with Encryption Support}
67 \index[general]{Building Bacula with Encryption Support}
69 The configuration option for enabling OpenSSL encryption support has not changed
70 since Bacula 1.38. To build Bacula with encryption support, you will need
71 the OpenSSL libraries and headers installed. When configuring Bacula, use:
74 ./configure --with-openssl ...
77 \section{Encryption Technical Details}
78 \index[general]{Encryption Technical Details}
80 The implementation uses 128bit AES-CBC, with RSA encrypted symmetric
81 session keys. The RSA key is user supplied.
82 If you are running OpenSSL 0.9.8 or later, the signed file hash uses
83 SHA-256 -- otherwise, SHA-1 is used.
85 End-user configuration settings for the algorithms are not currently
86 exposed -- only the algorithms listed above are used. However, the
87 data written to Volume supports arbitrary symmetric, asymmetric, and
88 digest algorithms for future extensibility, and the back-end
89 implementation currently supports:
93 - 128, 192, and 256-bit AES-CBC
96 Asymmetric Encryption (used to encrypt symmetric session keys):
106 The various algorithms are exposed via an entirely re-usable,
107 OpenSSL-agnostic API (ie, it is possible to drop in a new encryption
108 backend). The Volume format is DER-encoded ASN.1, modeled after the
109 Cryptographic Message Syntax from RFC 3852. Unfortunately, using CMS
110 directly was not possible, as at the time of coding a free software
111 streaming DER decoder/encoder was not available.
114 \section{Generating Private/Public Encryption Keys}
115 \index[general]{Generating Private/Public Encryption Keypairs}
117 Generate a Master Key Pair with:
121 openssl genrsa -out master.key 2048
122 openssl req -new -key master.key -x509 -out master.cert
126 Generate a File Daemon Key Pair for each FD:
130 openssl genrsa -out fd-example.key 2048
131 openssl req -new -key fd-example.key -x509 -out fd-example.cert
132 cat fd-example.key fd-example.cert >fd-example.pem
137 \section{Example Data Encryption Configuration}
138 \index[general]{Example!File Daemon Configuration File}
139 \index[general]{Example!Data Encryption Configuration File}
140 \index[general]{Example Data Encryption Configuration}
148 FDport = 9102 # where we listen for the director
149 WorkingDirectory = /var/bacula/working
150 Pid Directory = /var/run
151 Maximum Concurrent Jobs = 20
153 PKI Signatures = Yes # Enable Data Signing
154 PKI Encryption = Yes # Enable Data Encryption
155 PKI Keypair = "/etc/bacula/fd-example.pem" # Public and Private Keys
156 PKI Master Key = "/etc/bacula/master.cert" # ONLY the Public Key