journal features
movie reviews
photo of the day

Valentine's day vm backup plan

the journal of Michael Werneburg

twenty-seven years and one million words

Toronto, 2018.02.14

I'm working on a project in which the data set is so sensitive that backups to long-term media – or outside the production network segment – aren't permitted. The data's also supposed to be short-lived, and encrypted when not in use. Encryption, says the auditors, can't be done with a key residing on the server. All that said, we need to be able to recall data on an ad-hoc basis.

So I hand-rolled some backups, like it was the 90's. GPG to the rescue! As soon as the data is through the gate, I grab the files and encrypt them with a public key generated under a system account, on a separate server. I then dump the GPG'd files in a specific location, delete the unencrypted source files, and wait for an automated job on the second server to log in, pick up the encrypted files, and clean up the interim location on the production server.

Within a day, the copies retained on the second server are discarded as well.

In the normal course of production, we've had to go back to the backup server to restore files on a number of occasions. Everything seems to be working.

rand()m quote

It is not the critic who counts, not the man who points out how the strong man stumbled, or where the doer of deeds could have done better. The credit belongs to the man who is actually in the arena; whose face is marred by the dust and sweat and blood; who strives valiantly; who errs and comes short again and again, because there is no effort without error or shortcoming; who knows the great enthusiasms, the great devotions and spends himself in a worthy cause; who at the best, knows in the end the triumph of high achievement, and who, at worst, if he fails, at least fails while daring greatly; so that his place shall never be with those cold and timid souls who know neither victory or defeat.

—Theodore Roosevelt, Jr.