Keeping it safe
The recovery file, your master password, what someone with root on the Backup Server can and can't do, and how to move its VPN to a new range.
On this page
The Backup Server is built so that most mistakes can be undone. A few things are worth knowing before you need them, and this page is those things.
Two keys, one vault#
Every backup is encrypted with a password of its own, and the Backup Server keeps those passwords in one encrypted file, the vault. The vault opens with either of two keys.
- Your master password. You type it when you want to look at a stored password, change something in the vault, make a recovery file or change the master password itself. It is never stored on the server.
- The machine key. A file only root on the Backup Server can read. The nightly backups use it, so they carry on after a reboot with nobody there to type anything.
Why there are two
A backup server that needs you to type a password after every reboot stops making backups the first night you're away. Keeping a key on the server fixes that. The master password is the second lock, so you can still view, export and recover the vault from a file you keep somewhere else.
The recovery file#
The recovery file is a copy of the vault you can keep somewhere else. It holds the stored passwords, encrypted, and the master lock. It does not hold the machine key, so it is safe to keep off the Backup Server, and it opens only with your master password.
Make one as soon as the Backup Server is set up. In the panel, open Server → Vault, find Recovery file and press Download. It asks for the master password. Or from the terminal:
sudo librebackup vault export recovery-file
Give it a file name that doesn't exist yet. It refuses to overwrite one.
Keep the file where a fire or a theft at the Backup Server wouldn't reach it, such as your password manager's attachments, or a USB stick in a drawer at someone else's house. Keep your master password somewhere separate from the file. Together they open everything, so they're safest apart.
Using it on a rebuilt server#
The recovery file brings back the passwords. The backups themselves live on the Backup Server's disk. So the file is for a rebuilt server that still has that disk, or a copy of it.
Install the Backup Server as usual, then run:
sudo librebackup vault recover recovery-file
Type the master password. It restores the vault and makes a new machine key for this machine. The old machine key is useless on it. If it says a vault already exists, because the setup wizard makes one, move that file aside as the message says and run it again.
Make a new file after you change the master password
An older recovery file still opens with the master password it was made under. After you change it, download a fresh one, and throw the old one away.
Your master password#
Make it long and make it one you can't guess. A password manager is the right place for it. The wizard will generate a strong one if you let it.
You can change it later, from Server → Vault or with sudo librebackup vault change-passphrase. Changing it only replaces the master lock. Your stored passwords and the machine key stay as they were.
If you lose it#
Backups carry on running, because the machine key doesn't need it. What you lose is the way to view, export or change anything in the vault, and to recover onto a new server. A recovery file can't help, because it opens only with the master password.
The way out is a reset, done by root in a terminal on the Backup Server:
sudo librebackup vault reset
It keeps the old vault aside and makes a new one with a new master password. With no sources connected yet, that's all it does.
With sources connected, a reset costs you the backups
Every existing backup becomes unreadable. The data stays on the disk, but the passwords that open it were in the old vault. The command lists your sources and makes you type reset vault and lose backups before it goes on. If you can find the master password, do that instead.
Who can do what#
| Can do | Can't do | |
|---|---|---|
| Your install | Read its own backups, to restore them. | Write to or delete anything on the Backup Server, or see another install's backups. |
| Someone who breaks into your install | The same as the install: read that install's own backups. | Wipe your history, or reach any other source. |
| Someone on the VPN without a sign-in | Reach the sign-in page. | Do anything else. Five wrong passwords lock sign-in for 15 minutes. |
| Root on the Backup Server | Everything, including reading every backup. | Read your master password, because it isn't stored. |
Root on the Backup Server is the one that matters. Root can read the machine key, and with it open the vault and read every backup. The master password protects the vault from someone who only has a copy of it, such as the recovery file. It doesn't protect it from someone who is root on the live machine.
So keep the Backup Server to people you trust, and keep it patched, which it does itself. If its disk isn't encrypted, someone who takes the disk takes the machine key as well. Full-disk encryption is the answer to that. The Backup Server never touches the boot-time unlock of an encrypted disk, so you can still unlock it after a reboot.
Passwords you might have to change#
If you think a source's repository password may have been seen, rotate it. It adds a new password to the repository, checks that it works, and only then retires the old one. Old snapshots stay readable.
sudo librebackup vault unlock
sudo librebackup vault rotate NAME
sudo librebackup vault check
sudo librebackup vault lock
unlock asks for the master password and keeps a readable copy for 15 minutes. check should say every password opens its repository. If the new password doesn't verify, the old one stays current and nothing is lost.
Moving the VPN to a new range#
New Backup Servers pick a free random range inside 100.64.0.0/10, so phone VPN apps leave them alone. A server installed earlier is on 10.44.0.0/24, and a phone that's set not to route private addresses can't reach it. You can check yours with sudo librebackup vpn list.
To move it:
- Look first.
sudo librebackup vpn renumber --dry-runshows the range it would use and every device's new address. It changes nothing. - Move.
sudo librebackup vpn renumbermoves the VPN to that range. Every device keeps its key, name and rights and gets the same host number in the new range. Add--to 100.77.8.0/24to choose the range yourself. - Update each device. The command prints each device's new settings. Change its Address and AllowedIPs once, in the WireGuard app.
The move rewrites the panel's address and makes the certificate again from the same key, printing its new fingerprint. It checks that everything works on the new range, and if it doesn't, puts the old files back and starts the old range again. To go back to the previous range afterwards, run sudo librebackup vpn renumber --revert.
Not while installs are connected
An install keeps the address it was paired with, so a move would cut it off. The command refuses while an install is connected over the VPN. Do it before you connect installs, or remove the source first with sudo librebackup source remove NAME, which keeps its data. Otherwise, leave the range as it is.