-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On Sun, Nov 20, 2016 at 01:04:03PM +0100, David Hobach wrote: > On 11/20/2016 12:35 PM, Franz wrote: > > On Sun, Nov 20, 2016 at 7:21 AM, Stickstoff <[email protected]> wrote: > > > > > Hello dear new qubes family, > > > > > > I am having trouble designing a backup concept for my qubes workstation. > > > My goal is to have a (daily) copy of the entire workstation on a trusted > > > remote backup target (versioning, encryption, rotation is done > > > remotely). Only a small part of the local data ("vault") would need to > > > be encrypted before sending it on its way. > > > My plan was to use a dedicated backup-vm, locked down to only connect to > > > the remote target. > > > > > > - My first idea was to "mount --bind" the data to the backup-vm in > > > read-only mode. It would then do a simple rsync to the remote backup > > > target. This seems not to be possible, as I can't mount a directory from > > > outside, dom0, into the filesystem of the backup-vm. Mounting a > > > btrfs-snapshot would be a nice alternative, which doesn't seem to be > > > possible neither. > > That works. Just use qvm-block from dom0 to attach your other VMs to your > backup VM. Then you can e.g. start rsync in your backup VM from dom0 using > qvm-run. > > The concrete dom0 command should be > qvm-block -A [BACKUP_VM] dom0:/var/lib/qubes/appvms/[CLIENT_VM]/private.img > and then mount etc. in your backup VM using e.g. qvm-run.
This is risky. If one of your VMs is compromised, it may try to exploit some bug in filesystem handling code, or rsync, to steal data from other VMs. Handling this at block device level (so do not mount, but use /dev/xvdi as is) should be much safer. But then, you have qvm-backup tool which handle all this for you. The disadvantage (at least for now) is copy all the data each time - no support for incremental backups or such. > read-only didn't work though the last time I tested it (you can write anyway > - probably some bug). Yes, this one: https://github.com/QubesOS/qubes-issues/issues/2255 - -- Best Regards, Marek Marczykowski-Górecki Invisible Things Lab A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing? -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJYMaApAAoJENuP0xzK19csIzIIAIUsmVoT3OkLxXMPdJcya1hp LRPG+YxM09Zo8eVrMZwqGmnyew+YMb8p66yi0RMSUF2bPIoNmb0cNrfUCHzuSlXc Hd0eQ2cBFwCvVyzepxdUobkZebNiG+zylV6hEj3T9vpVXs0QYR6vbdHe90YO8yRe IpzzyG2/lPowNQOzbm3GN8EIISSymfuVqfFT4wXzZk2zdZAsJ63xsgO9PfAFghts k2f0zq763WtpbDcpNjAoBSsB5OjtKbCG4tBEO8AXSEfepzMssB99QAInfcEOiq1m L6AAcqPGUwPSj8Xa3iQ6VvnNowGjjOA2KxStmgN+XqzU5FCa/93ettIa/iukHIk= =gj/a -----END PGP SIGNATURE----- -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20161120130750.GF1145%40mail-itl. For more options, visit https://groups.google.com/d/optout.
