|
mac geekeryGet your geek on. |
Backing Up to a Disk Image With an SSH ConnectionMarch 8, 2007 - 11:35am
Patrick Patoray asks: QuestionIs there any way to store a encrypted disk image on a remote freeBSD server and mount it remotely through SSH for backing up to? Here’s the situation. I run a freebsd server, so I’ve got access to as much remote disk space as I need, but I want it to be secured, not just a directory on a remote server. What I’d really like to do is create a 50Gb encrypted DMG on my mac, park it on the remote server, and mount it remotely so that I can use rsync to write to it. AnswerYes, there is. MacFUSE includes a module for connecting to a remote system and getting SFTP access in the Finder. So you would use this to connect and mount the remote computer’s file system, make the disk image, and then backup to it. After installing MacFUSE, go to the downloads area of the project and get SSH-FS and open that up. It includes a GUI, but if your SSH is on a non-standard port on the remote server, this won’t work. Instead, follow the directions in the help for the actual binary the GUI is calling: $ /Volumes/sshfs/sshfs.app/Contents/Resources/sshfs-static -h That should get you started. Once it’s mounted, do what you’d normally do with a mounted disk. Just be very sure you understand this: You’re encrypting twice, so this is going to be a bit slower than normal. It’ll be secure, just slow. About Adam Knight |
|
||||
Encrypting the data a second time as it’s written to the disk image is not going to noticeably affect the speed of transfer. I’m sure the server’s throughput at encrypting a data stream is going to be many many times that of the incoming bandwidth. It’s the SSH transfer that slows it down, and that’s because, being encrypted, you cannot usefully compress the data in transit to reduce bandwidth.
And, thus, by double-encrypting it, it’s going to be a slow write. Yes.
On a side-note to ssh-fs – it possibly wont work that easy. I had the option
to use shfs in a commercial project and above filesizes fo 150-200Mbyte
the transfer showed faults (in perl and sh based shfs client testing). Otherwise
ssh-fs (shfs) is a beautiful solution.
You said you wanted 50Gb, so mouting a 50GB file can get tricky even
over seemingly “simple” protocols like NFS or WebDAV. Hence your server
uses BSD and not MacOSX you have no option of mounting the encrypted
DMGs on it, but only on your client. I suppose to make that work really good
one would need a block device driver over rsync like protocols, like iSCSI or
similar methods. But gi ahead, i am intersted to see if you succeed, if so you
found a solution me and others likely need also from time to time
I doubt that this will be any fun at all, unless maybe you’ve got a really high up- and download bandwidth on both ends.
Take a look at duplicity instead: http://www.nongnu.org/duplicity/
If you’re OK with a FreeBSD-specific solution, look at GELI. It’s part of the core system in 6.2, not sure earlier than that. We’re using it to create entire encrypted file systems for remote backup purposes with external drives. Then it’s just a matter of transporting your files using rsync over an ssh tunnel. I recommend using rsync becuase it only updates files that have changed on your end. For more information, look here: http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/disks-encrypting.html
GL!
Hi there, I posted the original question, and I wanted to post a quick update. This does exactly what I needed. A lot of the comments have focused on how slow it might be. My question was not worded clearly enough, but my intention is to use this strictly for rsyncing up a copy of my user folders into an encrypted image on the remote server. I wouldn't ever be accessing the data unless my laptop AND local backup discs were to be somehow destroyed.
Over the past two weeks, I've uploaded about 10Gb into an encrypted sparseimage that I created with 50Gb capacity. I've had to disconnect and reconnect to this sparseimage a number of times. It does take a minute or so to mount the image, and has taken longer and longer as the sparse image has grown.
Yes, the first sync up to the server is going to take forever, I'm guessing probably around a month due to slow DSL and the fact that I'm using --bwlimit=15 on the rsync command so I don't kill my own internet connection, but subsequent rsyncs will go much faster. I'm just hoping that I will be able to easily do an rsync backup overnight once weekly once the first rsync is done.
What web server software are you running? I ask because it’s my (limited) understanding that Apache can not make byte requests beyond 2 or 4 for gigs, meaning that files larger than that are not accessible. Though the disk image might be mountable, it won’t be accessible. You don’t seem to be having this problem, and I wonder why.