Yes, this is definitely doable!
You'll just want to run rsync from a remote machine.
To back up my encrypted data, I use an hourly cronjob, like this:
00 * * * * rsync -aP username@remotehost:/home/.ecryptfs/username /path/to/local/backup
Note that this directory, /home/.ecryptfs/username
, has two subdirectories:
/home/.ecryptfs/username/.ecryptfs
/home/.ecryptfs/username/.Private
The .ecryptfs
directory contains metadata about your eCryptfs mount:
-rw-r--r-- 1 username groupname 0 2011-05-02 17:38 auto-mount
-rw-r--r-- 1 username groupname 0 2011-05-02 17:38 auto-umount
-rw------- 1 username groupname 15 2011-05-02 17:38 Private.mnt
-rw------- 1 username groupname 34 2011-05-02 17:38 Private.sig
-rw------- 1 username groupname 48 2011-05-02 17:39 wrapped-passphrase
auto-mount
and auto-umount
are just flags; if present, pam_ecryptfs will automatically mount and unmount on login and logout.
Private.mnt
contains the path where your encrypted directory will be mounted, and this is typically either $HOME
or $HOME/Private
.
Private.sig
contains either one or two lines, specifying signatures or hashes of your mount key. The first line is always the signature of the file contents encryption key, and the second line if present is the signature of the file name encryption key.
wrapped-passphrase
is absolutely the most important file in this directory, and without which recovering your data will be pretty much impossible. Inside this file is your actual mount passphrase -- typically a string of 16 or 32 hexadecimal characters encrypted with your login passphrase.
You will most certainly want to store a backup of this file, but you may not want to store it in the same place (or on the same system) where you're backing up your encrypted data. You should really keep your keys and encrypted data separate.
Finally, the .Private
data contains your actual encrypted data.