I am having trouble setting up a system to backup a couple of computers, it has several partitions that are LVM on LUKS, and the server has no disk encryption. My computer is encrypted, and I am comfortable with storing the keys on it, but I am not finding any good ways to do so. The partitions are located on a network disk, and should be automatically mounted at boot on the client system. The server should not remember the key outside of RAM if possible. The server and my computer are on 18.10.

Edit: The server should not have access to the data if at all possible.

Edit 2: The system layout is https://m.imgur.com/a/pMX3o1e.

  • Can you clarify what you're trying to do? Are you trying to mount an encrypted volume over the network, or backup an encrypted volume in the encrypted state? – vidarlo Mar 23 '19 at 22:30
  • I am trying to mount the encrypted volume across my network so I can backup my system to it. – Holonium 2.0 Mar 23 '19 at 22:32
  • What protocol are you using? iSCSI might be able to do what you want. Or you may use e.g. ecryptfs over SMB... – vidarlo Mar 23 '19 at 22:32
  • I am using LUKS, the software that I will be using is Dulplicati, the drive is set up on USB, and I have key-based SSH to the computer. – Holonium 2.0 Mar 23 '19 at 22:35
  • You're using LUKS where? LUKS is block based, which pretty much means iSCSI. Furthermore, duplicati supports encryption, so the storage location doesn't have to do any encryption of its own. Do you really want encrypted storage on the server, or only encrypted backups? – vidarlo Mar 23 '19 at 22:37

You are asking how to access a LUKS encrypted disk remotely, without the server having access to the data. I will ignore that, because it's probably not what you want. You want encrypted backups, not encrypted block level access to a remote disk.

There's generally two ways I'd go about it this:

  • Use an encrypting filesystem.
  • Encrypt the backup in the backup program.

Encrypting file system

This is content neutral. Any content stashed onto the virtual file system will be encrypted, before being stored. The network access can be performed via e.g. Samba or NFS, sshfs, or any other technique for remotely accessing a file system.

encfs is a good encrypting virtual filesystem. You can install it with sudo apt install encfs

To create a virtual, encrypted filesystem, run the following in a terminal

encfs /path/to/mounted/remote/storage ~/encrypted_storage

This will start a wizard which lets you configure the storage. When it's created, and mounted, anything you put inside ~/encrypted_storage will be encrypted before actually being written to disk. The encryption will happen on the machine that you ran the encfs-command on.

To umount it run fusermount -u ~/encrypted_storage.

To mount it again, simply run the original command used for creating it, and it will detect it as an existing FS, and ask for the passphrase.

Encrypt the backup data

In my opinion this is a better solution. Especially as duplicati supports strong encryption, allowing both AES-256 and GPG as encryption options. GPG is fairly well vetted software, security wise.

In addition this makes it trivial to move your backup to other backup providers, e.g. BackBlaze, Amazon S3 or any other service: as the backup data itself is encrypted, you don't have to worry about your provider. The server will not have access to your backed up data, only metadata, such as when last backup was performed, size and what backup system was used. This metadata will be available to the server anyway.

If you really want LUKS for remote volumes, have a look at iSCSI. It's far more work to set up, far less flexible, and probably not what you want.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.