Encrypt backups#

Encrypt a backup archive by supplying a passphrase to mkectl backup. The passphrase must be at least 12 bytes; with ASCII characters, at least 12 characters.

Retain the mkectl build that created the archive

Restore requires the matching mkectl build that created the backup. Store each mkectl binary with the backups it creates, and retain it for as long as you retain those backups.

To create an encrypted backup:

Run mkectl backup and read the passphrase from a file through standard input:
```
mkectl backup -f <config_file_path> --passphrase - < /path/to/passphrase-file
```
Setting --passphrase to - configures mkectl to read the passphrase from standard input until end of file (EOF). Redirecting a file keeps the passphrase out of shell history and the process list.

Warning

Do not pass the passphrase as a literal value to --passphrase. Shell history records command-line arguments, and other users on the host can view them with tools such as ps.

Note

To enter the passphrase interactively, omit the file redirection, type the passphrase, press Enter, and then press Ctrl+D. The terminal displays the passphrase as you type it.
Record the MD5 checksum that mkectl backup prints on success. Use it to verify the archive before you restore it.
```
MD5 Checksum: dc701f1d34322a93edde41088425d4fe
```
Store the mkectl binary that created the archive alongside the archive, and keep it for as long as you retain the archive.

Note

An encrypted backup is a tar archive that contains two files: the unencrypted manifest mke-backup-manifest.json and the encrypted payload backup.tar.gpg. Running tar tf on the archive lists only these two files. The cluster data resides in the payload and is accessible only with the passphrase. To restore an encrypted backup, run mkectl restore.