linux - Storing locally encrypted incremental ZFS snapshots in Amazon Glacier -


to have off-site , durable backups of zfs pool, store zfs snapshots in amazon glacier. data need encrypted locally, independently amazon, ensure privacy. how accomplish this?

an existing snapshot can sent s3 bucket following:

zfs send -r <pool name>@<snapshot name> | gzip | gpg --no-use-agent  --no-tty --passphrase-file ./passphrase -c - | aws s3 cp - s3://<bucketname>/<filename>.zfs.gz.gpg 

or incremental back-ups:

zfs send -r -i <pool name>@<snapshot incremental backup from> <pool name>@<snapshot name> | gzip | gpg --no-use-agent  --no-tty --passphrase-file ./passphrase -c - | aws s3 cp - s3://<bucketname>/<filename>.zfs.gz.gpg 

this command take existing snapshot, serialize zfs send, compress it, , encrypt passphrase gpg. passphrase must readable on first line in ./passphrase file.

remember back-up passphrase-file separately in multiple locations! - if lose access it, you'll never able data again!

this requires:

  • a pre-created amazon s3 bucket
  • awscli installed (pip install awscli) , configured (aws configure).
  • gpg installed

lastly, s3 lifecycle rules can used transition s3 object glacier after pre-set amount of time (or immediately).


for restoring:

aws s3 cp - s3://<bucketname>/<filename>.zfs.gz.gpg | gpg --no-use-agent --passphrase-file ./passphrase -d - | gunzip | sudo zfs receive <new dataset name>  

Comments

Popular posts from this blog

ubuntu - PHP script to find files of certain extensions in a directory, returns populated array when run in browser, but empty array when run from terminal -

php - How can i create a user dashboard -

javascript - How to detect toggling of the fullscreen-toolbar in jQuery Mobile? -