Backup Central

Hello, just wondering if anyone has tried using EncFS with BackupPC and
if it's noticably slower?

Also, I'm after a way to make it so that if someone downloads a file via
the web interface, then they only way they can actually access that file
is with a special key of some sort. That way, sensitive information
can't be accessed by someone who happens to know someone elses password.
And by using EncFS, even if the backup server got stolen, then they
still wouldn't be able to access the partition.
Any ideas?



-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g.
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________
BackupPC-users mailing list
BackupPC-users < at > lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/backuppc-users
http://backuppc.sourceforge.net/

On 05/04 06:30 , Ben wrote:
Also, I'm after a way to make it so that if someone downloads a file via
the web interface, then they only way they can actually access that file
is with a special key of some sort.

once someone has access to the data; you've already lost a good chunk of the
battle; whether or not it's encrypted.

I would posit that it's more worthwhile to attempt to secure the BackupPC
interface. SSL is comparatively easy to set up, if you want to secure the
traffic from sniffing; and there are fairly strong authentication mechanisms
you can use in apache (better than crypt() which htpasswd uses by default).

It still won't stop someone from brute-forcing user passwords via the web
interface; but hopefully will slow them down long enough for you to notice.

Carl Soderstrom.
--
Systems Administrator
Real-Time Enterprises
www.real-time.com


-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g.
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________
BackupPC-users mailing list
BackupPC-users < at > lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/backuppc-users
http://backuppc.sourceforge.net/

On 05/04 04:17 , Carl Wilhelm Soderstrom wrote:
and there are fairly strong authentication mechanisms
you can use in apache (better than crypt() which htpasswd uses by default).

sorry. I'm not being very clear here. what I mean to say is that you can use
a password back-end mechanism which is stronger than crypt(); and it's a
good idea to do so, because crypt() only authenticates against the first 8
characters of the password.

also, stronger password-encryption mechanisms defend against password
cracks, in case someone managed to get your htpasswd file; but otherwise no
access to the rest of the files on the system. (tho much/most of the time,
if someone gets your htpasswd file; they very well can get other files off
the system, and you have bigger problems).

Carl Soderstrom.
--
Systems Administrator
Real-Time Enterprises
www.real-time.com


-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g.
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________
BackupPC-users mailing list
BackupPC-users < at > lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/backuppc-users
http://backuppc.sourceforge.net/

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Carl Wilhelm Soderstrom wrote:

| It still won't stop someone from brute-forcing user passwords via the web
| interface; but hopefully will slow them down long enough for you to
notice.

I think there is a apache module against such attacks.

When you need security in your network, use kerberos. Your Backup
machine should not run any other services than a web server, backuppc
and ssh (use keys, no passwords).
I would suggest not to use apache, use a simple script based webserver
which shouldn't be so easy to crack. Don't use any network based
authentication on your backup server nor any network drives except when
you have to make a backup from them.

Use a IDS like snort.


- --
nihil me cirumdat

.. . .. ... . . .. . ... . .. . ... . . .
pgp key < at > http://files.poelzi.org/pgp.txt
ED80 E53D 5269 4BB1 1E73 3A53 CBF9 A421 0A7B 003D
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Debian - http://enigmail.mozdev.org

iD8DBQFAmA3Ny/mkIQp7AD0RAlQVAJ4n7032tx9ZEBoaRfK7irbmZvdwrQCfeEja
JC03vzAHZbVielhnVi1nYXM=
=e1sb
-----END PGP SIGNATURE-----


-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g.
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________
BackupPC-users mailing list
BackupPC-users < at > lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/backuppc-users
http://backuppc.sourceforge.net/

On 05/04 11:40 , daniel.poelzleithner wrote:
Carl Wilhelm Soderstrom wrote:

| It still won't stop someone from brute-forcing user passwords via the web
| interface; but hopefully will slow them down long enough for you to
notice.

I think there is a apache module against such attacks.

this one, I belive:
http://freshmeat.net/projects/mod_dosevasive/

haven't tried it, but it looks interesting.

When you need security in your network, use kerberos.

that's a debatable matter. it's certainly very good in some situations, but
is painful to set up; and in most situations may not offer much over other,
less-intensive measures. that's a debate for another forum tho.

Your Backup
machine should not run any other services than a web server, backuppc
and ssh (use keys, no passwords).
I would suggest not to use apache, use a simple script based webserver
which shouldn't be so easy to crack.

any suggestions for which one?
I don't think thttpd supports CGIs; and I'm not familiar with any others.

Carl Soderstrom.
--
Systems Administrator
Real-Time Enterprises
www.real-time.com


-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g.
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________
BackupPC-users mailing list
BackupPC-users < at > lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/backuppc-users
http://backuppc.sourceforge.net/

Thanks for your help. I will look into stronger authentication on the
web side of things.

What about actual file system encryption? Has anyone implemented this?
And if so, does it slow it down much? I've done a bit of reading up on
it but apparently there is not much difference speed wise. Hopefully
won't run into any other issues. Am in the middle of building another
backup server and testing it so I'll post my results once it's finished.

On Wed, 2004-05-05 at 07:51, Carl Wilhelm Soderstrom wrote:
On 05/04 11:40 , daniel.poelzleithner wrote:
Carl Wilhelm Soderstrom wrote:

| It still won't stop someone from brute-forcing user passwords via the web
| interface; but hopefully will slow them down long enough for you to
notice.

I think there is a apache module against such attacks.

this one, I belive:
http://freshmeat.net/projects/mod_dosevasive/

haven't tried it, but it looks interesting.

When you need security in your network, use kerberos.

that's a debatable matter. it's certainly very good in some situations, but
is painful to set up; and in most situations may not offer much over other,
less-intensive measures. that's a debate for another forum tho.

Your Backup
machine should not run any other services than a web server, backuppc
and ssh (use keys, no passwords).
I would suggest not to use apache, use a simple script based webserver
which shouldn't be so easy to crack.

any suggestions for which one?
I don't think thttpd supports CGIs; and I'm not familiar with any others.

Carl Soderstrom.



-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g.
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________
BackupPC-users mailing list
BackupPC-users < at > lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/backuppc-users
http://backuppc.sourceforge.net/

On 05/05 10:01 , Ben wrote:
What about actual file system encryption? Has anyone implemented this?

haven't actually tried it myself; but I'm told that in the linux 2.6 kernel,
it will use the new Device Mapper interface to encrypt a filesystem, instead
of having to use the cryptoloop system.

one of those things I keep meaning to try out; but never quite have time
for.

Carl Soderstrom.
--
Systems Administrator
Real-Time Enterprises
www.real-time.com


-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g.
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________
BackupPC-users mailing list
BackupPC-users < at > lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/backuppc-users
http://backuppc.sourceforge.net/

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ben wrote:

| What about actual file system encryption? Has anyone implemented this?

Reiserfs4 will get a crypto plugin for the filesystem, which allows you
to encrypt only the directories you want to.

regards
~ Daniel

- --
nihil me cirumdat

.. . .. ... . . .. . ... . .. . ... . . .
pgp key < at > http://files.poelzi.org/pgp.txt
ED80 E53D 5269 4BB1 1E73 3A53 CBF9 A421 0A7B 003D
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Debian - http://enigmail.mozdev.org

iD8DBQFAmTW9y/mkIQp7AD0RAh70AJ47EmtCoEw5Lrn5l53qGEkG4dhomACfYMDP
MRpyYK/p4sCAlZpVU/4QZ1A=
=3u4T
-----END PGP SIGNATURE-----


-------------------------------------------------------
This SF.Net email is sponsored by Sleepycat Software
Learn developer strategies Cisco, Motorola, Ericsson & Lucent use to deliver
higher performing products faster, at low TCO.
http://www.sleepycat.com/telcomwpreg.php?From=osdnemail3
_______________________________________________
BackupPC-users mailing list
BackupPC-users < at > lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/backuppc-users
http://backuppc.sourceforge.net/

Thanks for the replies. I am going to use dm-crypt for my encryption. I
really would like to make it so that the reciever must have a private
key to access the data although I'm not sure if this is possible. For a
start, all the files need to be encrypted with gpg and second, they need
to be decrypted when a restore is requested. I just don't know if this
is possible? Unless you make it so that every file that is backed up
gets gpg --encrypt-files $_ so that it creates the .gpg which then moves
it to another directory that the CGI interface sees. A fairly big change
and I just don't think it's viable. Still, I'm open to suggestions

At least if I get the data encrypted through dm-crypt then it will
prevent the data from being stolen via theft. I wonder if apache has a
module that will only accept access if you have the key rather than any
kind of password authentication (like Daniel suggested, although that is
for ssh). Hmmm will look into this.

On Thu, 2004-05-06 at 04:43, daniel.poelzleithner wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ben wrote:

| What about actual file system encryption? Has anyone implemented this?

Reiserfs4 will get a crypto plugin for the filesystem, which allows you
to encrypt only the directories you want to.

regards
~ Daniel

- --
nihil me cirumdat

.. . .. ... . . .. . ... . .. . ... . . .
pgp key < at > http://files.poelzi.org/pgp.txt
ED80 E53D 5269 4BB1 1E73 3A53 CBF9 A421 0A7B 003D
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Debian - http://enigmail.mozdev.org

iD8DBQFAmTW9y/mkIQp7AD0RAh70AJ47EmtCoEw5Lrn5l53qGEkG4dhomACfYMDP
MRpyYK/p4sCAlZpVU/4QZ1A=
=3u4T
-----END PGP SIGNATURE-----



-------------------------------------------------------
This SF.Net email is sponsored by Sleepycat Software
Learn developer strategies Cisco, Motorola, Ericsson & Lucent use to deliver
higher performing products faster, at low TCO.
http://www.sleepycat.com/telcomwpreg.php?From=osdnemail3
_______________________________________________
BackupPC-users mailing list
BackupPC-users < at > lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/backuppc-users
http://backuppc.sourceforge.net/