Manage PGP and SSH key pairs used by the backup process
┌────────────────────────────────────────────────────────────────────────────┐
│ Backup on node1 (Version X.X.X build XXXX) │
└────────────────────────────────────────────────────────────────────────────┘
┌─┬──────────────────────────────────────────────────────────────────────────┐
│1│PGP Create a new PGP key pair for backups │
│2│PGP List all available PGP key pairs │
│3│PGP Export an existing PGP key pair │
│4│SSH Create a new SSH key pair for backups │
│5│SSH List all available SSH key pairs │
│6│SSH Export an existing SSH key pair │
└─┴──────────────────────────────────────────────────────────────────────────┘
Move the cursor or enter a it's corresponding number (Q to Quit)
Main> System Settings> Backup> Keys>
PGP Create a new PGP key pair for backups
Create a GnuPG key pair for encrypting all backups.
Full name <Not set>: Backup User #1
Email <Not set>: backup.user.one@corp.com
NOTE: Store this passphrase securely since it can potentially read all information in StoredSafe.
Passphrase: <passphrase stored on yubikey #1><passphrase stored on yubikey #2>
Re-enter passphrase: <passphrase stored on yubikey #1><passphrase stored on yubikey #2>
Name: Backup User #1
Email: backup.user.one@corp.com
Passphrase: <not shown>
Is the above configuration correct? (<Y>/n):
Successfully created a new GnuPG key pair for backups.
Press any key to continue
PGP List all available PGP key pairs
1) Backup User #1 <backup.user.one@corp.com> (64bit PGP Keyid: 0xF6A2DDF50B030231)
2) Backup User #2 <backup.user.two@corp.com> (64bit PGP Keyid: 0x90DB55393055099F)
Press any key to continue
Warning
The exported PGP secret key can decrypt every backup ever encrypted with it — treat the exported file as sensitive as the data it protects, and store it offsite under the same access control as your other master secrets (compare Key Escrow, which has similar handling requirements). Conversely, if this secret key is lost and not backed up anywhere else, none of your backups encrypted with it can ever be decrypted again — export and store it safely before you rely on backups encrypted with it.
PGP Export an existing PGP key pair
Export a backup PGP key pair
The corresponding PGP secret key used for the backups is required to decrypt
backups, hence it needs to be stored securely offsite.
1) Backup User #1 <backup.user.one@corp.com> (64bit PGP Keyid: 0xF6A2DDF50B030231)
2) Backup User #2 <backup.user.two@corp.com> (64bit PGP Keyid: 0x90DB55393055099F)
Export what PGP KeyID? <90DB55393055099F>: 2
Insert a USB disk and press enter when ready. Ready? (<Y>/n):
Ready to export the PGP key to "/mnt/usb"? (<Y>/n):
Copying the PGP secret key to "/mnt/usb/90DB55393055099F.key"
The PGP key "90DB55393055099F" was successfully exported to "/mnt/usb"
Press any key to continue
SSH Create a new SSH key pair for backups
Local SSH key
A SSH key pair is needed for transferring the backups to a remote host.
Locally available SSH keys intended for backup purposes:
Name of SSH key? <Not set>: Backup-SSH-Key-1
Successfully created the "Backup-SSH-Key-1" SSH key pair.
Press any key to continue
SSH List all available SSH key pairs
Locally available SSH keys intended for backup purposes:
Backup-SSH-Key-1
Backup-SSH-Key-2
Press any key to continue
SSH Export an existing SSH key pair
Export an existing SSH key
A copy of the public part of the SSH key pair needs to be added to the
~remote_user/.ssh/authorized_keys file on the remote host.
Locally available SSH keys intended for backup purposes:
Backup-SSH-Key-1
Backup-SSH-Key-2
Export which SSH key? <Backup-SSH-Key-2>: Backup-SSH-Key-1
Insert a USB disk and press enter when ready. Ready? (<Y>/n): y
Ready to export the SSH public key to "/mnt/usb"? (<Y>/n): y
The SSH key "Backup-SSH-Key-1" was successfully exported to "/mnt/usb"
Press any key to continue