Update documentation to say that passphrase is required for both repokey and keyfile modes #373

New Issue

jefferyto · 2020-11-24T12:57:55Z

jefferyto commented

2020-11-24 12:57:55 +00:00

borg's documentation is clear that a passphrase is required for keyfile modes:

If you want “passphrase and having-the-key” security, use one of the keyfile modes. The key will be stored in your home directory (in .config/borg/keys). In the attack scenario, the attacker who has just access to your repo won’t have the key (and also not the passphrase).

The user is also prompted for a passphrase when running sudo borgmatic init --encryption keyfile.

borgmatic's documentation makes it sound like the passphrase is only required for repokey modes. The places where I have found this are (there may be more):

Under "Encryption" in Set up backups:

If you encrypt your Borg repository with a passphrase instead of a key file, you'll either need to set the borgmatic encryption_passphrase configuration variable or set the BORG_PASSPHRASE environment variable.
In configuration comments in Configuration reference, for both encryption_passcommand and encryption_passphrase:

Only use on repositories that were initialized with passcommand/repokey encryption.

borg's documentation is clear that [a passphrase is required for keyfile modes](https://borgbackup.readthedocs.io/en/stable/usage/init.html#description): > If you want “passphrase and having-the-key” security, use one of the keyfile modes. The key will be stored in your home directory (in .config/borg/keys). In the attack scenario, the attacker who has just access to your repo won’t have the key (and also not the passphrase). The user is also prompted for a passphrase when running `sudo borgmatic init --encryption keyfile`. borgmatic's documentation makes it sound like the passphrase is only required for repokey modes. The places where I have found this are (there may be more): * Under "Encryption" in [Set up backups](https://torsion.org/borgmatic/docs/how-to/set-up-backups/#encryption): > If you encrypt your Borg repository with a passphrase instead of a key file, you'll either need to set the borgmatic `encryption_passphrase` configuration variable or set the `BORG_PASSPHRASE` environment variable. * In configuration comments in [Configuration reference](https://torsion.org/borgmatic/docs/reference/configuration/), for both `encryption_passcommand` and `encryption_passphrase`: > Only use on repositories that were initialized with passcommand/repokey encryption.

witten referenced this issue from a commit

2020-11-26 02:36:39 +00:00

Document that passphrase is used for Borg keyfile encryption, not just repokey encryption (#373).

witten commented

2020-11-26 04:06:35 +00:00

Fixed! Thank you so much for taking the time to report this and point out the specific offending passages. Made it really easy to rectify.

witten closed this issue

2020-11-26 04:06:35 +00:00

Sign in to join this conversation.