Yes, I think the "you will need them to create File Daemon keys" part is wrong. The part about using them if you lose the File Daemon keys is correct.
Bacula's data encryption doesn't use these keys directly to encrypt the data. Instead, it works by generating a random encryption key (called the session key) to encrypt the data and writes the session key to the volume, encrypted with the public key in the PKI Keypair file. This allows the session key to be decrypted using the private key in that file and then the data can be decrypted using the session key. If you also provide the PKI Master Key directive, then it writes a second copy of the session key encrypted with the master public key in that file. This allows the session key to also be decrypted using the master private key after following the instructions in https://docs.baculasystems.com/BEAdvancedFeaturesUsage/DataEncryption/FileDaemonEncryption/DecryptingWithMasterKey/index.html __Martin >>>>> On Thu, 5 Nov 2026 09:15:04 +0100, Stefan G Weichinger via Bacula-users >>>>> said: > > I plan to setup Data Encryption for some File-Daemons and started to > read and follow: > > https://docs.baculasystems.com/BEAdvancedFeaturesUsage/DataEncryption/FileDaemonEncryption/GeneratingEncryptionKeys/index.html > > The text says: > > "Save these files (master.key and master.cert) as you will need them to > create File Daemon keys or in case you loose the File Daemon keys." > > But the following example of generating the File Daemon Key Pair does > not depend on any of the two files master.key and master.cert > > I would expect the FD-keypair to be somehow signed by the master? > > In > https://docs.baculasystems.com/BEAdvancedFeaturesUsage/DataEncryption/FileDaemonEncryption/ExampleDataEncryptionConfiguration/index.html > > there is: > > PKI Keypair = "/opt/bacula/etc/fd-example.pem" # Public and > Private Keys > PKI Master Key = "/opt/bacula/etc/master.cert" # ONLY the Public Key > > but the fd-example.pem is in my opinion cryptographically not related to > master.cert at all, if following the commands on > https://docs.baculasystems.com/BEAdvancedFeaturesUsage/DataEncryption/FileDaemonEncryption/GeneratingEncryptionKeys/index.html > > > I'd like to be 100% sure to set this up correctly. Pls advise if I > misunderstand or if the commands should be slightly different. > > Thanks > > > > > _______________________________________________ > Bacula-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/bacula-users > _______________________________________________ Bacula-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/bacula-users
