Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 17 May 1999 09:29:33 -0400
From:      Adam Shostack <adam@homeport.org>
To:        "Isaac D. Kishk" <zippo@caffeine.io.com>
Cc:        freebsd-security@FreeBSD.ORG
Subject:   Re: secure backup
Message-ID:  <19990517092933.A2322@weathership.homeport.org>
In-Reply-To: <19990516234827.A2021@io.com>; from Isaac D. Kishk on Sun, May 16, 1999 at 11:48:27PM -0500
References:  <199905170014.MAA18766@smtp1.ihug.co.nz> <199905170151.UAA04558@alecto.physics.uiuc.edu> <19990516222325.A1851@weathership.homeport.org> <19990516234827.A2021@io.com>

next in thread | previous in thread | raw e-mail | index | archive | help
You don't need to.  The data is encrypted and signed.  (Thats the
benefit of using pgp over bdes; you can sign the data as it goes to
tape.)

Adam


On Sun, May 16, 1999 at 11:48:27PM -0500, Isaac D. Kishk wrote:
| 
| Small fundamental question... how would you trust the tape if the machine
| the tape is attached to is untrusted?
| 
| Adam Shostack emailed the following on Sun, May 16, 1999 at 10:23:25PM -0400:
| 
| [ ssh does not help; the host the tape is atatched to is untrusted.
| [ 
| [ Adam
| [ 
| [ On Sun, May 16, 1999 at 08:51:19PM -0500, Igor Roshchin wrote:
| [ | 
| [ | 
| [ | If both machines are Unix - you can use SSH.
| [ | 
| [ | I am using the following script:
| [ | (from the machine that I backup)
| [ | (Written for FreeBSD - so, you might want to optimize it differently -
| [ | if you using some other Unix - you might want to adjust the size of the buffer)
| [ | 
| [ | -------------------------------
| [ | #!/bin/csh -f
| [ | #
| [ | set SSH="ssh -c none -i /local-path-to-private/key backup@tape-machine.com /bin/dd bs=64k of=/dev/nrst0"
| [ | echo starting MyMachine
| [ | date
| [ | dump 0ubsdf 64 61000 100000 - / | /bin/dd bs=64k | $SSH
| [ | dump 0ubsdf 64 61000 100000 - /usr | /bin/dd bs=64k | $SSH
| [ | dump 0ubsdf 64 61000 100000 - /var | /bin/dd bs=64k | $SSH
| [ | dump 0ubsdf 64 61000 100000 - /mail | /bin/dd bs=64k | $SSH
| [ | --------------------------------
| [ | 
| [ | 
| [ | (backup - is the account of the user on the machine "tape-machine.com" -
| [ | the one which has the tape driver attached)
| [ | 
| [ | Hope, this helps,
| [ | 
| [ | IgoR
| [ | 
| [ | > Can anyone recommend how I should go about creating a backup to an untrusted
| [ | > machine that has the tape drive, and using an untrusted network.
| [ | > 
| [ | > I'm a bit wary of encrypting the output of tar or dump, as a single byte error
| [ | > would make the rest of the backup useless.  I'd like to encrypt (pgp?) each
| [ | > file separately as I go, so that a corrupted byte affects only one file on
| [ | > retrieval.  Is there an existing way to do this, or should I hack tar or dump
| [ | > into doing it?
| [ | > 
| [ | > 
| [ | > 
| [ | > To Unsubscribe: send mail to majordomo@FreeBSD.org
| [ | > with "unsubscribe freebsd-security" in the body of the message
| [ | > 
| [ | 
| [ | 
| [ | 
| [ | 
| [ | To Unsubscribe: send mail to majordomo@FreeBSD.org
| [ | with "unsubscribe freebsd-security" in the body of the message
| [ 
| [ -- 
| [ "It is seldom that liberty of any kind is lost all at once."
| [ 					               -Hume
| [ 
| [ 
| [ 
| [ 
| [ To Unsubscribe: send mail to majordomo@FreeBSD.org
| [ with "unsubscribe freebsd-security" in the body of the message
| 
| -- 
|    /******************************************************
|    ***** /\ **** Isaac D. Kishk - IDK5 -  zippo@io.com ***
|    **** /  \ *** Senior Network / Systems Administrator **
|    *** / () \ ** http://www.io.com/~zippo ****************
|    ** /______\ * 512.462.0999 - 512.462.0356(fax) ********
|    ******************************************************/
| 
| 
| To Unsubscribe: send mail to majordomo@FreeBSD.org
| with "unsubscribe freebsd-security" in the body of the message

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19990517092933.A2322>