Disaster Recovery Plan

#1

Hey,

i’m currently planing how i want to recover my data and backups with storj and wanted to know, how you guys do it. My current backup strategy:

  1. Every important file is stored in my own seafile cloud server hosted on a dedicated machine
  2. The whole seafile-cloud server is backed up daily with restic (encrypted) on the seafile server
  3. The restic backup is then pushed to storj/tardigrade

The issue is… all my keys and passwords to the encrypted restic repositories, and also the access grants of storj/tardigrade are stored in keypass… which itself are stored on my seafile cloud.

So when s*it hits the fan (i have to flee the country, or i loose my seafile cloud server and my laptop with my keypass file), all my data is securely backed up in storj, but i can’t access it because i don’t have the passwords.

I thought about printing out the access grant and restic passwords and storing it at a safe place. But everyone who sees the paper has access to all my data.

Or another issue: What if i just hit my head and forget the password to the keypass file? Everything i store is encrypted and i would loose all data.

I’d like to hear how you solve that issue.

hberg

1 Like
#2

This is an interesting discussion. Actual my Tardigrade encryption key is only in my head. And this can be an Issue

#3

I’d put it on a USB stick and encrypt it with a freely available encryption utility. I would keep said stick off site, in the event of a disaster event that takes out the property where the computers are at. You can of course make copies of the stick so you have it multiple places.

#4

Thanks, i’m now planing to do it like this:

  • Every password is stored in a keepass file on my seafile cloud
  • The password for my keypass file is also stored in my seafile cloud, somewhere hidden in plaintext
  • The seafile server and all devices are encrypted, so the hidden plaintext password can’t be read
  • The complete seafile server is backed up with restic (encrypted) as plain files
  • The restic repository is uploaded to storj
  • The access grant to storj and restic password is stored in a “disaster recovery” keepass file on multiple usb sticks and dropbox for remote access
  • The password for the “disaster recovery” keypass file is remembered and printed out and stored somewhere secure

Example situations:

I loose my memory and forget all passwords due to an accident
Path to recovery:

  1. Use paper with password + “disaster recovery” usb stick
  2. Open keypass file and gain access to storj
  3. Download restic repository, decrypt with password in keepass file
  4. All files are encrypted
  5. Open keepass files with hidden clear text password
  6. All passwords are encrypted

My notebook with all files is stolen AND the seafile server is online

  1. Access seafile cloud directly
  2. Continue with 2. from above

My notebook with all files is stolen AND the seafile server is offline

  1. Use dropbox and download “disaster recovery” keypass file
  2. Continue with 2. from above

The chance that my notebook is stolen AND my cloud server is offline is low, so the main culprit seems to be forgetting the password to the “disaster recovery” keepass file.

What do you think?

1 Like
#5

The logistical design seems good. Depending on how secure you’re going for here, I would consider using a hardware key in the event your machine gets compromised and they see you type in your passwords.

Ever heard of a Tempest system? Tempest (codename) - Wikipedia Kind of interesting in that passwords can be compromised even when no one is around. That Snowden hiding under the blanket trick is passive. Better to get a combo password and card, or at the very least some kind of two factor authentication.

Not you, just speaking in general. Your setup sounds secure. Unless you’re storing Shakespeare’s lost plays. In which case, maybe you need something more bullet proof. :wink:

#6

Here’s your answer

61N7VH40gvL.AC_SY355

1 Like