|
@@ -1,8 +1,5 @@
|
|
|
.\" Man page generated from reStructuredText.
|
|
|
.
|
|
|
-.TH BORG-INIT 1 "2021-07-12" "" "borg backup tool"
|
|
|
-.SH NAME
|
|
|
-borg-init \- Initialize an empty repository
|
|
|
.
|
|
|
.nr rst2man-indent-level 0
|
|
|
.
|
|
@@ -30,6 +27,9 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
|
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
|
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
|
|
|
..
|
|
|
+.TH "BORG-INIT" 1 "2022-06-04" "" "borg backup tool"
|
|
|
+.SH NAME
|
|
|
+borg-init \- Initialize an empty repository
|
|
|
.SH SYNOPSIS
|
|
|
.sp
|
|
|
borg [common options] init [options] [REPOSITORY]
|
|
@@ -37,32 +37,61 @@ borg [common options] init [options] [REPOSITORY]
|
|
|
.sp
|
|
|
This command initializes an empty repository. A repository is a filesystem
|
|
|
directory containing the deduplicated data from zero or more archives.
|
|
|
+.SS Encryption mode TLDR
|
|
|
.sp
|
|
|
-Encryption can be enabled at repository init time. It cannot be changed later.
|
|
|
+The encryption mode can only be configured when creating a new repository \-
|
|
|
+you can neither configure it on a per\-archive basis nor change the
|
|
|
+encryption mode of an existing repository.
|
|
|
.sp
|
|
|
-It is not recommended to work without encryption. Repository encryption protects
|
|
|
-you e.g. against the case that an attacker has access to your backup repository.
|
|
|
-.sp
|
|
|
-Borg relies on randomly generated key material and uses that for chunking, id
|
|
|
-generation, encryption and authentication. The key material is encrypted using
|
|
|
-the passphrase you give before it is stored on\-disk.
|
|
|
+Use \fBrepokey\fP:
|
|
|
+.INDENT 0.0
|
|
|
+.INDENT 3.5
|
|
|
.sp
|
|
|
-You need to be careful with the key / the passphrase:
|
|
|
+.nf
|
|
|
+.ft C
|
|
|
+borg init \-\-encryption repokey /path/to/repo
|
|
|
+.ft P
|
|
|
+.fi
|
|
|
+.UNINDENT
|
|
|
+.UNINDENT
|
|
|
.sp
|
|
|
-If you want "passphrase\-only" security, use one of the repokey modes. The
|
|
|
-key will be stored inside the repository (in its "config" file). In above
|
|
|
-mentioned attack scenario, the attacker will have the key (but not the
|
|
|
-passphrase).
|
|
|
+Or \fBrepokey\-blake2\fP depending on which is faster on your client machines (see below):
|
|
|
+.INDENT 0.0
|
|
|
+.INDENT 3.5
|
|
|
.sp
|
|
|
-If you want "passphrase and having\-the\-key" security, use one of the keyfile
|
|
|
-modes. The key will be stored in your home directory (in .config/borg/keys).
|
|
|
-In the attack scenario, the attacker who has just access to your repo won\(aqt
|
|
|
-have the key (and also not the passphrase).
|
|
|
+.nf
|
|
|
+.ft C
|
|
|
+borg init \-\-encryption repokey\-blake2 /path/to/repo
|
|
|
+.ft P
|
|
|
+.fi
|
|
|
+.UNINDENT
|
|
|
+.UNINDENT
|
|
|
.sp
|
|
|
-Make a backup copy of the key file (keyfile mode) or repo config file
|
|
|
-(repokey mode) and keep it at a safe place, so you still have the key in
|
|
|
-case it gets corrupted or lost. Also keep the passphrase at a safe place.
|
|
|
-The backup that is encrypted with that key won\(aqt help you with that, of course.
|
|
|
+Borg will:
|
|
|
+.INDENT 0.0
|
|
|
+.IP 1. 3
|
|
|
+Ask you to come up with a passphrase.
|
|
|
+.IP 2. 3
|
|
|
+Create a borg key (which contains 3 random secrets. See \fIkey_files\fP).
|
|
|
+.IP 3. 3
|
|
|
+Encrypt the key with your passphrase.
|
|
|
+.IP 4. 3
|
|
|
+Store the encrypted borg key inside the repository directory (in the repo config).
|
|
|
+This is why it is essential to use a secure passphrase.
|
|
|
+.IP 5. 3
|
|
|
+Encrypt and sign your backups to prevent anyone from reading or forging them unless they
|
|
|
+have the key and know the passphrase. Make sure to keep a backup of
|
|
|
+your key \fBoutside\fP the repository \- do not lock yourself out by
|
|
|
+"leaving your keys inside your car" (see \fIborg_key_export\fP).
|
|
|
+For remote backups the encryption is done locally \- the remote machine
|
|
|
+never sees your passphrase, your unencrypted key or your unencrypted files.
|
|
|
+Chunking and id generation are also based on your key to improve
|
|
|
+your privacy.
|
|
|
+.IP 6. 3
|
|
|
+Use the key when extracting files to decrypt them and to verify that the contents of
|
|
|
+the backups have not been accidentally or maliciously altered.
|
|
|
+.UNINDENT
|
|
|
+.SS Picking a passphrase
|
|
|
.sp
|
|
|
Make sure you use a good passphrase. Not too short, not too simple. The real
|
|
|
encryption / decryption key is encrypted with / locked by your passphrase.
|
|
@@ -84,13 +113,21 @@ a different keyboard layout.
|
|
|
.sp
|
|
|
You can change your passphrase for existing repos at any time, it won\(aqt affect
|
|
|
the encryption/decryption key or other secrets.
|
|
|
-.SS Encryption modes
|
|
|
+.SS More encryption modes
|
|
|
+.sp
|
|
|
+Only use \fB\-\-encryption none\fP if you are OK with anyone who has access to
|
|
|
+your repository being able to read your backups and tamper with their
|
|
|
+contents without you noticing.
|
|
|
+.sp
|
|
|
+If you want "passphrase and having\-the\-key" security, use \fB\-\-encryption keyfile\fP\&.
|
|
|
+The key will be stored in your home directory (in \fB~/.config/borg/keys\fP).
|
|
|
.sp
|
|
|
-You can choose from the encryption modes seen in the table below on a per\-repo
|
|
|
-basis. The mode determines encryption algorithm, hash/MAC algorithm and also the
|
|
|
-key storage location.
|
|
|
+If you do \fBnot\fP want to encrypt the contents of your backups, but still
|
|
|
+want to detect malicious tampering use \fB\-\-encryption authenticated\fP\&.
|
|
|
.sp
|
|
|
-Example: \fIborg init \-\-encryption repokey ...\fP
|
|
|
+If \fBBLAKE2b\fP is faster than \fBSHA\-256\fP on your hardware, use \fB\-\-encryption authenticated\-blake2\fP,
|
|
|
+\fB\-\-encryption repokey\-blake2\fP or \fB\-\-encryption keyfile\-blake2\fP\&. Note: for remote backups
|
|
|
+the hashing is done on your local machine.
|
|
|
.\" nanorst: inline-fill
|
|
|
.
|
|
|
.TS
|
|
@@ -192,13 +229,13 @@ repository to create
|
|
|
.BI \-e \ MODE\fR,\fB \ \-\-encryption \ MODE
|
|
|
select encryption key mode \fB(required)\fP
|
|
|
.TP
|
|
|
-.B \-\-append\-only
|
|
|
+.B \-\-append\-only
|
|
|
create an append\-only mode repository
|
|
|
.TP
|
|
|
.BI \-\-storage\-quota \ QUOTA
|
|
|
Set storage quota of the new repository (e.g. 5G, 1.5T). Default: no quota.
|
|
|
.TP
|
|
|
-.B \-\-make\-parent\-dirs
|
|
|
+.B \-\-make\-parent\-dirs
|
|
|
create the parent directories of the repository directory, if they are missing.
|
|
|
.UNINDENT
|
|
|
.SH EXAMPLES
|