What is the master key and how do I protect it?
The master key is a single file value in /etc/backupwall/backupwall.env. It is the only key to your encrypted backups and your saved destination passwords, it exists on your server and in your passphrase-sealed DR bundle, and PortWall never has it. If you lose every copy, encrypted backups can never be read.
What the master key is
The master key (MASTER_ENCRYPTION_KEY_B64 in /etc/backupwall/backupwall.env, 32 bytes, mode 640, root:backupwall) is generated by the installer on your server. All other keys are derived from it: the AES-256-GCM key that seals encrypted backups, and the keyed hash that names encrypted objects. It also encrypts, in the database, your destination passwords, panel tokens and two-factor secrets. It is not in any backup point and PortWall never receives it.
What happens if you lose it
- Encrypted backups can never be read again, by anyone, PortWall included.
- Saved destination passwords and keys can never be recovered.
- There is no key rotation.
Backups of jobs without encryption stay readable, but BackupWall still loses its list of jobs and destinations unless you have the database.
How to protect it
- Set up Disaster Recovery. The DR bundle holds BackupWall's database and
backupwall.env(with the master key), sealed with a passphrase only you know. See Set up Disaster Recovery. - Keep the passphrase off this server, in a password manager. It cannot be reset.
- Keep your own off-server copy of
/etc/backupwall/backupwall.env. - Never delete that file on a server that has backups. A new installer run would generate a different key. On an upgrade the installer keeps the existing file: "Existing configuration kept".
- Uninstalling copies the file to
/root/backupwall-backup-<time>/first. Keep that folder until you are sure you do not need the backups.
What never to share
Never send these in a support ticket: /etc/backupwall/backupwall.env, your Disaster Recovery passphrase, a .bwdr file together with its passphrase, panel API tokens, destination keys or SFTP private keys. The support bundle removes secrets from what it collects. If you pasted a secret into a message by mistake, tell PortWall.