Re: Job switch for encryption?

Bill Arlofski via Bacula-users <[email protected]> Thu, 30 Jan 2025 17:42:25 +0000

Newsgroups	gmane.comp.bacula.user
Message-ID	<[email protected]>

On 1/30/25 3:43 AM, Marco Gaiarin wrote:
> Mandi! Bill Arlofski via Bacula-users
>    In chel di` si favelave...
> 
>> Not a stupid question, but you are correct.
>> What you can do is run two FDs on a client (on different ports), one with encryption enabled and the other with no
>> encryption. Then, just use the right FD for the jobs you want encrypted or not.
> 
> Ok. Just i'm here, another 'stupid' question. ;-)

:)


> I enable encryption with:
> 	PKI Signatures = Yes
> 	PKI Encryption = Yes
> 
> i know encryption theory, so it is clear that encryption need signatures. But:
> 
> a) how 'PKI Signatures = Yes' relate to job's 'Options { Signature = MD5 }' ?

These two things are 100% unrelated in Bacula.

The `signature` setting in a Fileset's Options{} block is used to create and add a hash of each file to the catalog so that 
on restore or verify it can be confirmed that the data that is restored/verified is exactly as it was when the filedaemon 
read it an
d created the hash during the backup job.


> b) what happen if i set 'PKI Encryption = Yes' and 'PKI Signatures = No'?

The Filedaemon will encrypt, but not sign the data it sends to the SD during a backup.

This may clarify it better: https://www.securew2.com/blog/pki-digital-signature


Hope this helps,
Bill

-- 
Bill Arlofski
[email protected]

_______________________________________________
Bacula-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bacula-users

signature.asc (application/pgp-signature, 509 B)