How do I encrypt my backups, and what is encrypted?
Switch on Encrypt backup data when you create a job. File contents, databases, mail, SSL private keys, password hashes and crontabs are then sealed with AES-256-GCM before they reach the destination, using a key that stays on your server. It is off by default.
Turn it on
- Set up Disaster Recovery first, because encrypted backups can be restored only with this server's master key. See Set up Disaster Recovery.
- When you create a job (Backup jobs → + New job), tick Encrypt backup data.
Encryption is a per-job switch and it is off by default. Without it, only your destination passwords are encrypted: backup data and manifests, including SSL private keys and password hashes, sit on the destination in the clear. If you do not want SSL keys stored, switch off SSL certificates in the job.
What is encrypted
With the switch on: file contents, databases, mail, SSL private keys, mailbox and database-user password hashes, login hashes, crontabs and autoresponder texts are sealed with AES-256-GCM (authenticated encryption, so a tampered or wrong-key object is detected). Crontab commands, mailing-list names and addresses, and the other secrets in a backup's manifest are sealed too.
Since build v240, an encrypted job also names every stored object with a keyed hash. Someone who holds the destination can no longer test whether a file they already have is in an encrypted backup.
What stays readable at the destination
File and folder names, sizes, modes, owners and dates; account names, domains, package and contact email; database and database-user names; mailbox addresses; FTP account names; DNS zones in full; certificates (the public part); the schedule of each cron line; and exclude patterns. Treat the destination as secret storage: use a private bucket or a locked-down SFTP account.
Turning it on later
Switching Encrypt backup data on for an existing job applies to new backup points. The next backup of each account reads every file and uploads it again, encrypted. Until the older points leave retention and the space is reclaimed, the destination holds roughly a second copy of the data, so check there is room first. Older, unencrypted points stay as they were until retention removes them. To be sure everything is encrypted from the start, create a new job with the option on. Turning it off again writes the secrets of new points in the clear.
Restoring encrypted backups
- Encrypted backups can be restored only with this server's master key. See Protect the master key.
- Restore with the same or a newer BackupWall build. An older build cannot restore encrypted points correctly (builds before v232 and v240 mishandle them).
- Seed migration refuses encrypted backups; use Direct push. The source opens them and the target stores them with its own key.
bw-extractcan read encrypted backups with the master key file or a DR bundle and passphrase.