mirror
/
borg
mirror of https://github.com/borgbackup/borg.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #5115 from ThomasWaldmann/redo-pr-4269 

docs: clarify borg init's encryption modes
This commit is contained in:
TW 2020-04-21 11:45:40 +02:00 committed by GitHub
parent cac301ef25 b5d6e23d84
commit 27a41f5c1f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 18 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/usage/init.rst
View File

@ -11,7 +11,9 @@ Examples
$ borg init --encryption=none /path/to/repo
# Remote repository (accesses a remote borg via ssh)
# repokey: stores the (encrypted) key into <REPO_DIR>/config
$ borg init --encryption=repokey-blake2 user@hostname:backup
# Remote repository (store the key your home dir)
# Remote repository (accesses a remote borg via ssh)
# keyfile: stores the (encrypted) key into ~/.config/borg/keys/
$ borg init --encryption=keyfile user@hostname:backup

19
src/borg/archiver.py
View File

@ -3629,7 +3629,11 @@ class Archiver:
It is not recommended to work without encryption. Repository encryption protects
you e.g. against the case that an attacker has access to your backup repository.
But be careful with the key / the passphrase:
Borg relies on randomly generated key material and uses that for chunking, id
generation, encryption and authentication. The key material is encrypted using
the passphrase you give before it is stored on-disk.
You need to be careful with the key / the passphrase:
If you want "passphrase-only" security, use one of the repokey modes. The
key will be stored inside the repository (in its "config" file). In above
@ -3667,6 +3671,12 @@ class Archiver:
Encryption modes
++++++++++++++++
You can choose from the encryption modes seen in the table below on a per-repo
basis. The mode determines encryption algorithm, hash/MAC algorithm and also the
key storage location.
Example: `borg init --encryption repokey ...`
.. nanorst: inline-fill
+----------+---------------+------------------------+--------------------------+
@ -3682,7 +3692,8 @@ class Archiver:
.. nanorst: inline-replace
`Marked modes` are new in Borg 1.1 and are not backwards-compatible with Borg 1.0.x.
Modes `marked like this` in the above table are new in Borg 1.1 and are not
backwards-compatible with Borg 1.0.x.
On modern Intel/AMD CPUs (except very cheap ones), AES is usually
hardware-accelerated.
@ -3715,8 +3726,8 @@ class Archiver:
This mode is new and *not* compatible with Borg 1.0.x.
`none` mode uses no encryption and no authentication. It uses SHA256 as chunk
ID hash. Not recommended, rather consider using an authenticated or
authenticated/encrypted mode. This mode has possible denial-of-service issues
ID hash. This mode is not recommended, you should rather consider using an authenticated
or authenticated/encrypted mode. This mode has possible denial-of-service issues
when running ``borg create`` on contents controlled by an attacker.
Use it only for new repositories where no encryption is wanted **and** when compatibility
with 1.0.x is important. If compatibility with 1.0.x is not important, use