0

Let's say we have:

  • a local computer (Windows or Linux)
  • a distant dedicated server with 2TB storage, running Linux

I'd like to do a backup my local computer's data folder (1 TB) to the distant server (updated every week of a few GB), but I have a very specific requirement:

  • I want that that even if a hacker gets root access on the distant server, they cannot use the data.

  • NB: The files never needs to be used on the distant server, it's only for storage, the data never needs to be used on that distant server.

  • TL;DR I want that the data is totally impossible to use on the distant server.

I was thinking about using rsync, but then the files are in the filesystem of the distant server, and thus it can be read by a hacker if he gets root.

(Working) proof of concept but totally inefficient: do a backup_20201116_1538.7z archive of the whole data with 7Zip, AES-encrypted with a long password/key. Send this file to server. If someone has root access on the server, he has access to this .7z file, but he cannot do anything with it because he doesn't have the decryption key.

Inefficient because:

  1. I need to make a temporary .7z file of ~ 800 GB before being able to send it via SFTP!

  2. If next week I want to update the backup I need to resend a new 800 GB (argh!), so it's not incremental / diff like rsync!

Improve this question

1 Answer 1

Reset to default
3

You can use Duplicity or Rsyncrypto to achieve this. It will auto encrypt your files on the fly before it reaches the destination server.

Improve this answer
3
  • Thank you for your answer. What is the main advantage of using Duplicity / Rsyncrypto over normal rsync over SSH (which is encrypted)? How is it stored on the destination server?
    – Basj
    Commented Nov 16, 2020 at 15:26
  • It encrypts the data at rest not just the data in transit.
    – Lucas Kauffman
    Commented Nov 16, 2020 at 15:26
  • Ok thank you @LucasKauffman. I just tried a little bit duplicity. Unfortunately if you rename the filename of a 10GB file, 10GB of data will be resent over the network :( See unix.stackexchange.com/questions/619938/… and the "Handle renames" column of wiki.archlinux.org/index.php/….
    – Basj
    Commented Nov 16, 2020 at 16:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .