What do I need to create backups as reliable and secured archives?

Question

I backup my files to external HDD. I want to backup regularly, and secure them, in case that somebody steals my external HDD.

I'd like to make scripts, which will create secured backup archives, with following requirements:

• security: encrypted by key-pair:
  • encryption key is stored unprotected with the script
  • decryption key is password protected, and stored with archived data (along, or right inside archive)
  • I don't want the password to be stored anywhere along the backup script, or the data
  • the key-pair could be asymmetrically encrypted symmetric key
• reliability: in case HDD gets corrupted, the error won't affected whole archive (just some files in the archive)

I can create shell script with all the fancy (add timestamps, rsync, etc...). So, I'm not asking how to make such script.

What tool/archive-format/combination-of-tools provides such security and reliability for backup archives?

Answer 1

You should look at duplicity, which uses rsync and gpg to do encrypted backups. They can be full backups or incremental with only changes added.

There is a more user-friendly graphical front-end deja-dup. Both packages should be available for most Linux distributions. Make sure you keep a second copy of the encryption key somewhere, and occasionally test that you can restore from your backups.

Answer 2

When it comes to backups, I strongly suggest using a pre-existing tool rather than rolling your own. Borg is a very nice backup tool which supports encryption and decryption following the usage patterns you describe (albeit not with a key pair): you can create a backup repository which is encrypted with a key stored in the repository, protected with a passphrase, which you can specify in an environment variable when adding to the backup. Thus you can set up an automated encryption job without any input (not even the passphrase), but the backup medium on its own is useless without the passphrase.