2 \section*{Bacula -- Data Encryption}
4 \index[general]{Data Encryption}
5 \index[general]{Encryption!Data}
6 \index[general]{Data Encryption}
7 \addcontentsline{toc}{section}{Data Encryption}
9 Bacula permits file data encryption and signing within the File Daemon (or
10 Client) prior to sending data to the Storage Daemon. Upon restoration,
11 file signatures are validated and any mismatches are reported. At no time
12 does the Director or the Storage Daemon have access to unencrypted file
16 It is very important to specify what this implementation does NOT
19 \item There is still one major gotcha, namely, it's possible for the
20 director to restore new keys or a Bacula configuration file to the
21 client, and thus force later backups to be made with a compromised
22 key and/or with no encryption at all. You can avoid this by not backing
23 up your encryption keys using Bacula, and not changing the location
24 of the keys in your Bacula File daemon configuration file. However,
25 please be sure your File daemon keys securely backed up preferably
28 \item The implementation does not encrypt file metadata such as file path
29 names, permissions, and ownership. Extended attributes are also currently
30 not encrypted. However, Mac OS X resource forks are encrypted.
33 Encryption and signing are implemented using RSA private keys coupled with
34 self-signed x509 public certificates. This is also sometimes known as PKI
35 or Public Key Infrastructure.
37 Each File Daemon should be given its own unique private/public key pair.
38 In addition to this key pair, any number of "Master Keys" may be specified
39 -- these are key pairs that may be used to decrypt any backups should the
40 File Daemon key be lost. Only the Master Key's public certificate should
41 be made available to the File Daemon. Under no circumstances should the
42 Master Private Key be shared or stored on the Client machine.
44 The Master Keys should be backed up to a secure location, such as a CD
45 placed in a in a fire-proof safe or bank safety deposit box. The Master
46 Keys should never be kept on the same machine as the Storage Daemon or
47 Director if you are worried about an unauthorized party compromising either
48 machine and accessing your encrypted backups.
50 While less critical than the Master Keys, File Daemon Keys are also a prime
51 candidate for off-site backups; burn the key pair to a CD and send the CD
52 home with the owner of the machine.
54 NOTE!!! If you lose your encryption keys, backups will be unrecoverable.
55 {\bf ALWAYS} store a copy of your master keys in a secure, off-site location.
57 \subsection*{Building Bacula with Encryption Support}
58 \index[general]{Building Bacula with Encryption Support}
59 \addcontentsline{toc}{subsection}{Building Bacula with Encryption Support}
61 The configuration option for enabling OpenSSL encryption support has not changed
62 since Bacula 1.38. To build Bacula with encryption support, you will need
63 the OpenSSL libraries and headers installed. When configuring Bacula, use:
66 ./configure --with-openssl ...
72 \subsection*{Generating Private/Public Encryption Keypairs}
73 \index[general]{Generating Private/Public Encryption Keypairs}
74 \addcontentsline{toc}{subsection}{Generating Private/Public Encryption Keypairs}
76 Generate a Master Key Pair with:
80 openssl genrsa -out master.key 2048
81 openssl req -new -key master.key -x509 -out master.cert
85 Generate a File Daemon Key Pair for each FD:
89 openssl genrsa -out fd-example.key 2048
90 openssl req -new -key fd-example.key -x509 -out fd-example.cert
91 cat fd-example.key fd-example.cert >fd-example.pem
96 \subsection*{Example Data Encryption Configuration}
97 \index[general]{Example!File Daemon Configuration File}
98 \index[general]{Example!Data Encryption Configuration File}
99 \index[general]{Example Data Encryption Configuration}
100 \addcontentsline{toc}{subsection}{Example Data Encryption Configuration}
108 FDport = 9102 # where we listen for the director
109 WorkingDirectory = /var/bacula/working
110 Pid Directory = /var/run
111 Maximum Concurrent Jobs = 20
113 PKI Signatures = Yes # Enable Data Signing
114 PKI Encryption = Yes # Enable Data Encryption
115 PKI Keypair = "/etc/bacula/fd-example.pem" # Public and Private Keys
116 PKI Master Key = "/etc/bacula/master.cert" # ONLY the Public Key