Introduction
Introduction Statistics Contact Development Disclaimer Help
Simpler Encrypted LTO Tape Archives
___ _ _
/ __| (_) _ __ _ __ | | ___ _ _
\__ \ | | | ' \ | '_ \ | | / -_) | '_|
|___/ |_| |_|_|_| | .__/ |_| \___| |_|
|_|
___ _ _
| __| _ _ __ _ _ _ _ _ __ | |_ ___ __| |
| _| | ' \ / _| | '_| | || | | '_ \ | _| / -_) / _` |
|___| |_||_| \__| |_| \_, | | .__/ \__| \___| \__,_|
|__/ |_|
_ _____ ___
| | |_ _| / _ \
| |__ | | | (_) |
|____| |_| \___/
_____
|_ _| __ _ _ __ ___
| | / _` | | '_ \ / -_)
|_| \__,_| | .__/ \___|
|_|
_ _ _
/_\ _ _ __ | |_ (_) __ __ ___ ___
/ _ \ | '_| / _| | ' \ | | \ V / / -_) (_-<
/_/ \_\ |_| \__| |_||_| |_| \_/ \___| /__/
╔─*──*──*──*──*──*──*──*──*──*──*�…
║1 ........................................ 1║
║2* ........................................ *2║
║3 ........................................ 3║
║1 ...........Posted: 2024-11-18........... 1║
║2* Tags: sysadmin linux lto backup_archive *2║
║3 ........................................ 3║
║1 ........................................ 1║
╚─────────────────────────�…
Simple setup for encrypted backups using LTO6 on Debian. I have an older, very
similar article:
Archiving with LTO & zpaq
I've found tapes are just best to write once and forget about it. Trying to do
updates over time is kind of a pain and I've found it unreliable in some ways.
I have an external LTO6 drive.
## Drive-based key encryption, if you want (I don't suggest)
I actually have found this extremely unreliable and frustrating. I suggest just
handling encryption yourself, not through the drive. I believe this is because
of a bug[1] where, basically, you have to avoid `--details` at all costs or
it'll put the drive in a weird state. You can do streaming-based encryption with
GPG or something.
Install from here: https://github.com/scsitape/stenc (do NOT grab what's
available in Debian). Dont' forget to `sudo make install`.
Generate key (max is 256 bits):
```
sudo stenc -g 256 -k /etc/2024-11-lto5.key -kd "November 2024 LTO5 Tape Key"
```
Turn on encryption (you may want to first power cycle [wait for indicators to be
stable on lto bay] and then do this BEFORE you put in the cartridge):
```
% sudo stenc -f /dev/st0 -a 1 -e on -k /etc/tape-stenc-2025-05-11.key
Decrypt mode not specified, using decrypt = on
Changing encryption settings for device /dev/st0...
Success! See system logs for a key change audit log.
```
At this point I noticed the blue encryption indicator lit up on my LTO5 drive.
## Making the archive
Choose between `zstd` (faster) and `xz` (better compression ratio), but both are
built for streams, I think.
```
sudo tar \
--exclude=/home/baudrillard/.bitmonero \
--exclude=/root/.bitmonero \
--exclude=/nix \
--exclude=/snap \
--exclude=/var/cache \
--exclude=/mnt \
--exclude=/tmp \
--exclude=/media \
--exclude=/run \
--exclude=/var/tmp \
--exclude=/lost+found \
--exclude=/sys \
--exclude=/usr/share/ollama/.ollama/models/blobs \
--exclude=/proc \
--exclude=/dev \
--totals --checkpoint=100 --checkpoint-action=dot \
--use-compress-program="zstd" -cvf /dev/st0 /
```
NOte for above: actually to be encrypted may want to do nst0, like this command,
which uses pgp to encrypt, instead of relying on firmware encryption of the
drive (I like using pgp more [make sure key light is off!]):
```
# first the passphrase creation
sudo sh -c 'umask 077; openssl rand -base64 48 > /etc/backup.passphrase'
# now create the archive
sudo sh -c '
tar --totals \
--checkpoint=100 \
--checkpoint-action=dot \
--use-compress-program="zstd" \
-cvf - /media/root/BackupRAID \
| gpg --symmetric --cipher-algo AES256 \
--batch --yes \
--pinentry-mode loopback \
--passphrase-file /etc/backup.passphrase \
| dd of=/dev/nst0 bs=1M status=progress
'
```
This is crazy fast. But if blocking factor is large you'll run out of space
quickly. The solution is to perhaps place a single archive onto the tar.
## Test archive, restore
See status:
```
sudo stenc -f /dev/st0
```
Rewind and list contents:
```
sudo mt -f /dev/nst0 rewind
sudo tar -tvf /dev/nst0 --use-compress-program=zstd
```
### if you used pgp (best imo)
Read test successful with:
```
sudo mt -f /dev/nst0 rewind
sudo dd if=/dev/nst0 bs=64k count=1 | file -
# Expect: "GPG symmetrically encrypted data"
```
and...
```
sudo mt -f /dev/nst0 rewind
sudo dd if=/dev/nst0 bs=1M \
| gpg --decrypt --batch --yes \
--pinentry-mode loopback \
--passphrase-file /etc/backup.passphrase \
| tar --use-compress-program="zstd" -tvf -
```
you can confirm integrity this way:
```
sudo mt -f /dev/nst0 rewind
sudo dd if=/dev/nst0 bs=1M \
| gpg --decrypt --batch --yes \
--pinentry-mode loopback \
--passphrase-file /etc/backup.passphrase \
| tar --use-compress-program="zstd" -tvf - > /dev/null
```
extract...
```
sudo mt -f /dev/nst0 rewind
sudo dd if=/dev/nst0 bs=1M \
| gpg --decrypt --batch --yes \
--pinentry-mode loopback \
--passphrase-file /etc/backup.passphrase \
| sudo tar --use-compress-program="zstd" -xvf -
```
## Tips
* Tapes will like just writing one big file--so don't be afraid to just slap a
highly compressed archive onto there. It might be fun for me to show how to
zpaq to tape, especially incrementally. Or using restic?
* Bigger block sizes and such for larger data
* If you have tape labels you can use a program on your phone like Orca Scan to
keep a tape catalog
## Footnotes
[1]: a bug: https://serverfault.com/questions/864580/what-could-cause-a-sense-e…
You are viewing proxied material from gopher.someodd.zip. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.