restic-backup-suite: Security

Security in restic-backup-suite: where the repository password, SSH key and database passwords live, file permissions, temporary dumps and what happens if the password is lost.

Deutsche Version

Back to overview

Security

Where credentials live

Secret	Location	Mode
Repository password	File from `RESTIC_PASSWORD_FILE` (template: `/etc/restic/password.txt`)	set by you, 400 or 600 recommended
SSH key for SFTP	File from `SSH_KEY_FILE`, the script applies `chmod 600`	600
Database passwords	Inside the container (environment variable). `config.sh` only holds the variable's name
S3/B2 credentials	If used, in the environment, for example via `export` in `config.sh`	600

The scripts do not write passwords to log files or into the clone's directory.

File permissions set by the installer

Path	Mode
`/etc/restic/`	700
`/etc/restic/config.sh`	600
`/etc/restic/config.example.sh`	640
`/var/log/restic/`	750
Marker file	600
Temporary dump and restore directories	700

config.sh is executed as Bash code. Anyone who can write it runs code as root. Keep it unreadable and unwritable for other users. In the clone directory config.sh is excluded from commits through .gitignore.

The repository password

restic encrypts the repository. Without the password the backups are unusable, there is no recovery.
If /etc is in BACKUP_PATHS (as in the template), /etc/restic/password.txt ends up in the backup too. That does not help you, because without the password you cannot open the backup. Keep the password separately from the server as well.
install.sh --uninstall deletes /etc/restic when you confirm. If the password file lives there, it is gone afterwards.

SSH configuration

For SFTP repositories backup.sh writes a host entry with IdentitiesOnly yes, PreferredAuthentications publickey, PasswordAuthentication no, ServerAliveInterval 60, ServerAliveCountMax 3 and ConnectTimeout 30. There is no password login. Host key checking stays at SSH's default, and the connection test runs with BatchMode=yes and fails on an unknown host key.

Database dumps

Dumps briefly exist unencrypted in /tmp/restic-db-dump-XXXXXX (mode 700) and are deleted on exit. In the repository they are encrypted.
For Docker MariaDB/MySQL the script passes the password as a -p argument to mariadb-dump inside the container. It is visible in the process list there for the duration of the dump.
For native dumps the script uses the calling root user's access without a password.

Restore

Restored files live in the restore directory (mode 700) and stay there until you delete it. Remove it after use if it holds sensitive data.