Update documentation to say that passphrase is required for both repokey and keyfile modes #373

New issue

Closed

opened 2020-11-24 12:57:55 +00:00 by jefferyto · 1 comment

jefferyto commented

2020-11-24 12:57:55 +00:00

Contributor

borg's documentation is clear that a passphrase is required for keyfile modes:

If you want “passphrase and having-the-key” security, use one of the keyfile modes. The key will be stored in your home directory (in .config/borg/keys). In the attack scenario, the attacker who has just access to your repo won’t have the key (and also not the passphrase).

The user is also prompted for a passphrase when running sudo borgmatic init --encryption keyfile.

borgmatic's documentation makes it sound like the passphrase is only required for repokey modes. The places where I have found this are (there may be more):

Under "Encryption" in Set up backups:

If you encrypt your Borg repository with a passphrase instead of a key file, you'll either need to set the borgmatic encryption_passphrase configuration variable or set the BORG_PASSPHRASE environment variable.
In configuration comments in Configuration reference, for both encryption_passcommand and encryption_passphrase:

Only use on repositories that were initialized with passcommand/repokey encryption.

borg's documentation is clear that [a passphrase is required for keyfile modes](https://borgbackup.readthedocs.io/en/stable/usage/init.html#description): > If you want “passphrase and having-the-key” security, use one of the keyfile modes. The key will be stored in your home directory (in .config/borg/keys). In the attack scenario, the attacker who has just access to your repo won’t have the key (and also not the passphrase). The user is also prompted for a passphrase when running `sudo borgmatic init --encryption keyfile`. borgmatic's documentation makes it sound like the passphrase is only required for repokey modes. The places where I have found this are (there may be more): * Under "Encryption" in [Set up backups](https://torsion.org/borgmatic/docs/how-to/set-up-backups/#encryption): > If you encrypt your Borg repository with a passphrase instead of a key file, you'll either need to set the borgmatic `encryption_passphrase` configuration variable or set the `BORG_PASSPHRASE` environment variable. * In configuration comments in [Configuration reference](https://torsion.org/borgmatic/docs/reference/configuration/), for both `encryption_passcommand` and `encryption_passphrase`: > Only use on repositories that were initialized with passcommand/repokey encryption.