3

I'm setting up my backup and restoration scripts on my Linux Mint machine to an external hard-drive using rsync.

When I installed the system it was marked the option to encrypt the /home partition.

So, should I assume that doing the backup with Rsync the files will be encrypted at the external drive as well?

I know this is kind of a noob question, but I wanna be sure because I had my laptop stolen in the past and my girlfriend panicked! ;)

I looked for how to know if a certain partition is encrypted or not and run this command on the terminal (BACKUP/ is the label of my external hard drive).

fabio@fabio-ThinkPad-X250:/$ ls -lA /media/fabio/BACKUP/backup-total/fabio/
total 972
drwxrwxr-x  29 fabio fabio   4096 Nov 30 19:40  Ads
drwxrwxr-x   5 fabio fabio   4096 Nov 30 21:04  .atom
-rw-------   1 fabio fabio  11776 Jan  2 14:54  .bash_history
-rw-r--r--   1 fabio fabio    220 Dec 12 19:32  .bash_logout
-rw-r--r--   1 fabio fabio   3979 Jan  1 03:55  .bashrc
drwxrwxr-x   2 fabio fabio   4096 Jan  2 18:54  bin
drwxrwxr-x 170 fabio fabio  12288 Dec 24 00:30  CalibreLibrary
drwxrwxr-x   2 fabio fabio   4096 Nov  9 16:06  Cherrytree
drwxrwxr-x  11 fabio fabio   4096 Nov  9 16:06  Cidadania
drwxr-xr-x  43 fabio fabio   4096 Jan  2 16:13  .config
drwx------   2 fabio fabio   4096 Dec 14 00:10  .dbus
drwxr-xr-x   2 fabio fabio   4096 Dec 29 00:44  Desktop
-rw-r--r--   1 fabio fabio     21 Dec 26 20:44  .dmrc
drwxrwxr-x  11 fabio fabio   4096 Nov 23 18:24  Documents
drwxr-xr-x   8 fabio fabio   4096 Jan  2 19:02  Downloads
drwx------   8 fabio fabio   4096 Dec 13 04:38  .dropbox
drwx------  33 fabio fabio   4096 Dec 13 04:13  Dropbox
drwxrwxr-x   3 fabio fabio   4096 Dec 11 17:06  .dropbox-dist
**lrwxrwxrwx   1 fabio fabio     31 Dec 12 19:32  .ecryptfs -> /home/.ecryptfs/fabio/.ecryptfs**
drwxrwxr-x   4 fabio fabio   4096 Nov 21 13:59  Escritorio
drwxrwxr-x  11 fabio fabio   4096 Nov  9 16:11  Estudos
-rw-rw-r--   1 fabio fabio 589652 Dec 19 12:54  .face
drwx------   3 fabio fabio   4096 Dec 20 20:08  .gnome
drwx------   3 fabio fabio   4096 Dec 12 17:36  .gnupg
-rw-rw-r--   1 fabio fabio    593 Nov 29 00:02  .gtkrc-2.0
-rw-r--r--   1 fabio fabio    516 Nov 11 18:09  .gtkrc-xfce
-rwxrwxr-x   1 fabio fabio  13425 Dec 27 02:14  instalar1
drwxrwxr-x   3 fabio fabio   4096 Dec 12 19:37  .linuxmint
drwxr-xr-x   3 fabio fabio   4096 Dec 12 17:36  .local
drwx------   2 fabio fabio   4096 Dec 22 10:45  Mail
-rw-rw-r--   1 fabio fabio    641 Dec 21 15:50  microsoft.gpg
drwx------   5 fabio fabio   4096 Dec 19 00:30  .mozilla
drwxr-xr-x  11 fabio fabio   4096 Dec 22 15:40  Music
-rw-rw-r--   1 fabio fabio     63 Dec 13 23:00  .nehmconfig
drwxrwxr-x   3 fabio fabio   4096 Dec 22 08:31  Nextcloud
drwxrwxr-x  15 fabio fabio   4096 Nov 13 20:21  Pictures
drwx------   3 fabio fabio   4096 Dec 13 03:12  .pki
**lrwxrwxrwx   1 fabio fabio     30 Dec 12 19:32  .Private -> /home/.ecryptfs/fabio/.Private**
-rw-r--r--   1 fabio fabio    807 Dec 12 19:32  .profile
drwxr-xr-x   2 fabio fabio   4096 Dec 12 17:36  Public
-rw-------   1 fabio fabio     13 Dec 13 13:30  .python_history
drwxrwxr-x   7 fabio fabio   4096 Dec 27 11:31  rofi-calc
drwxrwxr-x   3 fabio fabio   4096 Dec 27 02:58  rsync-homedir-excludes
drwxrwxr-x   9 fabio fabio   4096 Dec  7 05:40  Scripts
drwxr-xr-x   5 fabio fabio   4096 Dec 20 13:45  snap
-rw-r--r--   1 fabio fabio      0 Dec 12 20:14  .sudo_as_admin_successful
drwx------   2 fabio fabio   4096 Jan  1 23:53  .synaptic
drwxrwxr-x   3 fabio fabio  36864 Jan  2 14:55  tagspaces
drwxrwxr-x   2 fabio fabio   4096 Dec 22 11:46  Templates
drwx------   6 fabio fabio   4096 Dec 20 19:51  .thunderbird
drwxrwxr-x   3 fabio fabio   4096 Dec 19 21:08  Vagrant
drwxrwxr-x   7 fabio fabio   4096 Dec 22 16:20  .vagrant.d
drwxrwxr-x   3 fabio fabio   4096 Dec 25 05:50  .var
drwxrwxr-x   3 fabio fabio   4096 Nov  9 16:34  Viagem
drwxrwxr-x   3 fabio fabio   4096 Nov  9 16:34  Videos
drwx------   3 fabio fabio   4096 Nov 12 02:43 'VirtualBox VMs'
drwxrwxr-x   3 fabio fabio   4096 Dec 21 15:52  .vscode
drwxrwxr-x  14 fabio fabio   4096 Nov 12 15:06  Websites
-rw-rw-r--   1 fabio fabio    131 Dec 13 03:03  .xinputrc
-rw-------   1 fabio fabio 116415 Jan  1 05:22  .xsession-errors.old
  • 3
    You should not assume anything ! I don't use Mint (but extensively use Ubuntu) and its likely that these backups are unencrypted. – davidgo Apr 5 at 2:12
  • I'm asking because due to the fact that encryption takes time I prefer not encrypt over already encrypted files. If it is possible. But thanks! – FabioB Apr 5 at 2:23
  • 5
    @davidgo: Even more importantly, TEST YOUR RESTORE. Nobody gives a hoot about backups. What they care about is the ability to restore. I know a company that bought a very expensive tape robot based backup system with backups distributed across two facilities and locked in a fire-proof safe. They regularly tested their backups, and their backups where perfect. Then, when disaster hit and they wanted to restore, they discovered that the firmware of the SCSI controller was unable to boot the machine from the tape robot … – Jörg W Mittag Apr 5 at 9:22
  • 2
    @JörgWMittag is completely correct! A backup which one has not tested a restore from is not a known good backup. – Josh Apr 5 at 14:22
  • 2
    Another important point: rsync isn't a backup. It could be a part of a backup solution, but it's not a back up solution by itself. It's a scheduled rsync is no better than a RAID 1 setup. You might have two copies of your data, but the moment you're hit by a bit flip, file corruption, a randomware attack, etc., you now have 2 great copies of your corrupted data. To repeat: RSYNC IS NOT A BACKUP. – Alexander - Reinstate Monica Apr 5 at 16:18
15

No.

Just because the source directory is encrypted does not mean the Rsynced files will themselves be encrypted.

So, should I assume that doing the backup with Rsync the files will be encrypted at the external drive as well?

Nope. I do not use Linux Mint, but what you are describing isn’t how home directory encryption works. Here is the breakdown of the basic concept regardless of system being used:

  • Source Directory/Partition Should Be Encrypted: If your source directory is encrypted, only those files in that source directory are encrypted on that source system.
  • Copied Files from that Source Are Not Encrypted: The second you copy that file via any method to that other device, the file is not encrypted. Remember… The directory or partition is what is encrypted, not the file itself.
  • Destination Directory/Partition Should Be Encrypted: If you want your backup to be encrypted, you need to encrypt the destination disk as well in some way.

I do a similar thing to thing with some of my work files on macOS: I have an encrypted USB flash drive that I only decrypt to copy work files to. If someone stole that USB flash drive from me, they see nothing unless they somehow can know or guess the password. The biggest loss I would incur is the cost of the USB flash drive since all they could do with it is format it; my data is 100% safe.

So unless your BACKUP/ hard disk is encrypted, utterly nothing is encrypted on BACKUP/.

And yes you do see files like .ecryptfs copied over to the external disk BACKUP/. Those are just config files copied from the source directory; they are not part of an actively encrypted file system.

If you want an encrypted backup disk, that backup disk must be encrypted. What happens on the source doesn’t matter once the file is copied elsewhere.

| improve this answer | |
3

Data on encrypted partitions is automatically decrypted when it is accessed. There is no difference between an access through rsync or any other program.

Encrypted partitions protect "data at rest", i.e. make it impossible to access the data bypassing the operating system (e.g. by moving the harddisk to another machine, or by booting a rescue system).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.