BorgBackup – a deduplicating archiver with compression and encryption
root@bpi-iot-jsho-borg-01:~# apt-get update -y
root@bpi-iot-jsho-borg-01:~# apt-get install borgbackup
root@bpi-iot-jsho-borg-01:~# borg –version
borg 1.2.0
root@bpi-iot-jsho-borg-01:~#
root@bpi-iot-jsho-borg-01:~# mkdir /borgbackup.data
oot@bpi-iot-jsho-borg-01:~# borg init –encryption=repokey /borgbackup.data
Enter new passphrase: <password>
Enter same passphrase again: <password>
root@bpi-iot-jsho-borg-01:~#
root@bpi-iot-jsho-borg-01:/# borg create –stats /borgbackup.data::`date „+Backup-%Y-%d-%d-%H:%M:%S“` /resilio-sync.data
Enter passphrase for key /borgbackup.data: <password>
——————————————————————————
Repository: /borgbackup.data
Archive name: Backup-2022-01-01-12:42:07
Archive fingerprint: c98f79eb4e84b0b0a49877d394ef2de27517e4f8126c0f140bbc40fdf743cda5
Time (start): Fri, 2022-07-01 12:42:18
Time (end): Fri, 2022-07-01 12:49:06
Duration: 6 minutes 48.81 seconds
Number of files: 2438
Utilization of max. archive size: 0%
——————————————————————————
Original size Compressed size Deduplicated size
This archive: 2.10 GB 1.29 GB 1.28 GB
All archives: 2.10 GB 1.29 GB 1.28 GB
Unique chunks Total chunks
Chunk index: 2747 3049
——————————————————————————
root@bpi-iot-jsho-borg-01:/#
root@bpi-iot-jsho-borg-01:/# borg list /borgbackup.data
Enter passphrase for key /borgbackup.data: <password>
Backup-2022-01-01-12:42:07 Fri, 2022-07-01 12:42:18 [c98f79eb4e84b0b0a49877d394ef2de27517e4f8126c0f140bbc40fdf743cda5]
root@bpi-iot-jsho-borg-01:/#
root@bpi-iot-jsho-borg-01:/# borg delete /borgbackup.data::Backup-2022-01-01-12:42:07
Enter passphrase for key /borgbackup.data: <password>
root@bpi-iot-jsho-borg-01:/#
Use lz4 compression – very fast but low compression ratio (default)
root@bpi-iot-jsho-borg-01:/# borg create –compression lz4 –stats /borgbackup.data::`date „+Backup-%Y-%d-%d-%H:%M:%S“` /resilio-sync.data
Enter passphrase for key /borgbackup.data: <password>
——————————————————————————
Repository: /borgbackup.data
Archive name: Backup-2022-01-01-13:05:31
Archive fingerprint: cbbdef87b74dac396d5028612f000045a1499f3e1dcf6fe6976f4179b41f7fa8
Time (start): Fri, 2022-07-01 13:05:42
Time (end): Fri, 2022-07-01 13:12:29
Duration: 6 minutes 46.94 seconds
Number of files: 2438
Utilization of max. archive size: 0%
——————————————————————————
Original size Compressed size Deduplicated size
This archive: 2.10 GB 1.29 GB 1.28 GB
All archives: 2.10 GB 1.29 GB 1.28 GB
Unique chunks Total chunks
Chunk index: 2746 3048
——————————————————————————
root@bpi-iot-jsho-borg-01:/#
root@bpi-iot-jsho-borg-01:/# borg list /borgbackup.data
Enter passphrase for key /borgbackup.data: <password>
Backup-2022-01-01-13:05:31 Fri, 2022-07-01 13:05:42 [cbbdef87b74dac396d5028612f000045a1499f3e1dcf6fe6976f4179b41f7fa8]
root@bpi-iot-jsho-borg-01:/#
root@bpi-iot-jsho-borg-01:/# borg create –compression lz4 –stats /borgbackup.data::`date „+Backup-%Y-%d-%d-%H:%M:%S“` /resilio-sync.data
Enter passphrase for key /borgbackup.data: <password>
——————————————————————————
Repository: /borgbackup.data
Archive name: Backup-2022-01-01-13:25:25
Archive fingerprint: 5ecf2025dce21c495375df43995205139b20275ed630511a91c071da5364c70f
Time (start): Fri, 2022-07-01 13:25:36
Time (end): Fri, 2022-07-01 13:25:45
Duration: 9.16 seconds
Number of files: 2440
Utilization of max. archive size: 0%
——————————————————————————
Original size Compressed size Deduplicated size
This archive: 2.10 GB 1.29 GB 2.87 kB
All archives: 4.20 GB 2.58 GB 1.28 GB
Unique chunks Total chunks
Chunk index: 2750 6098
——————————————————————————
root@bpi-iot-jsho-borg-01:/#
To specify a passphrase without human intervention is to create a file with a password in it in your home directory and use permissions to keep anyone else from reading it
root@bpi-iot-jsho-borg-01:~# (umask 0077; head -c 32 /dev/urandom | base64 -w 0 > ~/.borg-passphrase)
root@bpi-iot-jsho-borg-01:~# export BORG_PASSCOMMAND=“cat $HOME/.borg-passphrase
The prune command prunes a repository by deleting all archives not matching any of the specified retention options
# Keep 7 end of day 4 additional end of week archives and an end of month archive for every month:
root@bpi-iot-jsho-borg-01:/# borg prune -v –list –keep-daily=7 –keep-weekly=4 –keep-monthly=-1 /borgbackup.data
# Keep all backups in the last 10 days 4 additional end of week archives and an end of month archive for every month:
root@bpi-iot-jsho-borg-01:/# borg prune -v –list –keep-within=10d –keep-weekly=4 –keep-monthly=-1 /borgbackup.data
# Script to keep all backups from the actual day the last backup for 14 days for 6 month and an end of year backup:
export BORG_PASSCOMMAND=“cat /root/.borg-passphrase“
borg create –compression lz4 –stats /borgbackup.data::`date „+Backup-%Y-%d-%d-%H:%M:%S“` /resilio-sync.data
borg prune -v –list –keep-within 1d –keep-daily 14 –keep-monthly 6 –keep-yearly 1 /borgbackup.data
borg compact /borgbackup.data
borg list /borgbackup.data
How to use BorgBackup over your network – backup the local server to a remote machine
root@bpi-iot-jsho-borg-02:~# apt-get update -y
root@bpi-iot-jsho-borg-02:~# apt-get install borgbackup
root@bpi-iot-jsho-borg-02:~# borg –version
borg 1.2.0
root@bpi-iot-jsho-borg-02:~#
root@bpi-iot-jsho-borg-02:~# mkdir /borgbackup.data
root@bpi-iot-jsho-borg-01:~# borg init –encryption=repokey root@bpi-iot-jsho-borg-02:/borgbackup.data
root@bpi-iot-jsho-borg-02’s password: <password>
Enter new passphrase: <password>
Enter same passphrase again: <password>
Do you want your passphrase to be displayed for verification? [yN]: n
By default repositories initialized with this version will produce security
errors if written to with an older version (up to and including Borg 1.0.8).
If you want to use these older versions, you can disable the check by running:
borg upgrade –disable-tam ssh://root@bpi-iot-jsho-borg-02/borgbackup.data
See https://borgbackup.readthedocs.io/en/stable/changes.html#pre-1-0-9-manifest-spoofing-vulnerability for details about the security implications.
IMPORTANT: you will need both KEY AND PASSPHRASE to access this repo!
If you used a repokey mode, the key is stored in the repo, but you should back it up separately.
Use „borg key export“ to export the key, optionally in printable format.
Write down the passphrase. Store both at safe place(s).
root@bpi-iot-jsho-borg-01:~#
root@bpi-iot-jsho-borg-01:~# borg create –stats root@bpi-iot-jsho-borg-02:/borgbackup.data::`date „+Backup-%Y-%d-%d-%H:%M:%S“` /resilio-sync.data
root@bpi-iot-jsho-borg-02’s password: <password>
Enter passphrase for key ssh://root@bpi-iot-jsho-borg-02/borgbackup.data: <password>
——————————————————————————
Repository: ssh://root@bpi-iot-jsho-borg-02/borgbackup.data
Archive name: Backup-2022-04-04-19:31:49
Archive fingerprint: e93e47a73b6897fa445e9b126d3dbd454b747031fe715ea5b38ed9ae6c101401
Time (start): Mon, 2022-07-04 19:32:38
Time (end): Mon, 2022-07-04 19:40:55
Duration: 8 minutes 16.04 seconds
Number of files: 2445
Utilization of max. archive size: 0%
——————————————————————————
Original size Compressed size Deduplicated size
This archive: 2.10 GB 1.29 GB 1.28 GB
All archives: 2.10 GB 1.29 GB 1.28 GB
Unique chunks Total chunks
Chunk index: 2746 3049
——————————————————————————
root@bpi-iot-jsho-borg-01:~#
root@bpi-iot-jsho-borg-01:~# borg list root@bpi-iot-jsho-borg-02:/borgbackup.data
root@bpi-iot-jsho-borg-02’s password: <password>
Enter passphrase for key ssh://root@bpi-iot-jsho-borg-02/borgbackup.data: <password>
Backup-2022-04-04-19:31:49 Mon, 2022-07-04 19:32:38 [e93e47a73b6897fa445e9b126d3dbd454b747031fe715ea5b38ed9ae6c101401]
Backup-2022-04-04-19:43:01 Mon, 2022-07-04 19:43:28 [ff2241e8d1f3c76270c65db089c5a65208f5447d25af970d9497a1b74ed97ede]
root@bpi-iot-jsho-borg-01:~#
root@bpi-iot-jsho-borg-01:~# borg delete root@bpi-iot-jsho-borg-02:/borgbackup.data
root@bpi-iot-jsho-borg-02’s password: <password>
Enter passphrase for key ssh://root@bpi-iot-jsho-borg-02/borgbackup.data: <password>
You requested to completely DELETE the repository *including* 2 archives it contains.
Type ‚YES‘ if you understand this and want to continue: YES
root@bpi-iot-jsho-borg-01:~#
root@bpi-iot-jsho-borg-01:~# borg list root@bpi-iot-jsho-borg-02:/borgbackup.data
root@bpi-iot-jsho-borg-02’s password: <password>
Repository root@bpi-iot-jsho-borg-02:/borgbackup.data does not exist.
root@bpi-iot-jsho-borg-01:~#
root@bpi-iot-jsho-borg-01:~# borg key export root@bpi-iot-jsho-borg-02:/borgbackup.data
root@bpi-iot-jsho-borg-02’s password: <password>
BORG_KEY cd88b62118b7dd628427837630824131f3abc8af18811b73f560fcce89201cf4
hqlhbGdvcml0aG2mc2hhMjU2pGRhdGHaAN4R/IvMspOh12yx34fJmnhcdreyogreGkm7rG
…
1hZNNiUvWynIawLUXpjuDDQDux5u/I66G0cwpfxkqfSSy3Ebur+kaGFzaNoAICppAZEg+k
frGyAAK1IyrTx4jkX55wFohYd6xICrvuApqml0ZXJhdGlvbnPOAAGGoKRzYWx02gAg26Hb
cqxAJmjF56LVyAX9qz+U+oZYdoNY1FDWrBRjMTandmVyc2lvbgE=
root@bpi-iot-jsho-borg-01:~#
root@bpi-iot-jsho-borg-01:~# borg init –encryption=keyfile root@bpi-iot-jsho-borg-02:/borgbackup.data
root@bpi-iot-jsho-borg-02’s password: <password>
Enter new passphrase: <password>
Enter same passphrase again: <password>
Do you want your passphrase to be displayed for verification? [yN]: n
By default repositories initialized with this version will produce security
errors if written to with an older version (up to and including Borg 1.0.8).
If you want to use these older versions, you can disable the check by running:
borg upgrade –disable-tam ssh://root@bpi-iot-jsho-borg-02/borgbackup.data
See https://borgbackup.readthedocs.io/en/stable/changes.html#pre-1-0-9-manifest-spoofing-vulnerability for details about the security implications.
IMPORTANT: you will need both KEY AND PASSPHRASE to access this repo!
If you used a repokey mode, the key is stored in the repo, but you should back it up separately.
Use „borg key export“ to export the key, optionally in printable format.
Write down the passphrase. Store both at safe place(s).
root@bpi-iot-jsho-borg-01:~# ls -la
total 596
drwx—— 6 root root 4096 Jul 4 19:13 .
drwxr-xr-x 22 root root 4096 Jul 1 12:18 ..
-rw-r–r– 1 root root 957 Mar 31 11:11 –
-rw——- 1 root root 5556 Jul 4 20:00 .bash_history
-rw-r–r– 1 root root 3771 Jun 23 04:08 .bashrc
-rw-r—– 1 root root 522695 Jul 5 12:05 borgbackup.log
-rwxrwx— 1 root root 362 Jul 3 19:08 borgbackup.sh
-rw——- 1 root root 9 Jul 1 18:44 .borg-passphrase
drwx—— 4 root root 4096 Jul 1 12:19 .cache
drwx—— 8 root root 4096 Jul 1 12:44 .config
-rw-r–r– 1 root root 119 Jul 1 09:54 echo
-rw——- 1 root root 20 Jul 1 10:05 .lesshst
drwxr-xr-x 3 root root 4096 Jun 23 04:17 .oh-my-zsh
-rw-r–r– 1 root root 75 Jul 1 18:54 .selected_editor
drwx—— 2 root root 4096 Jul 4 19:13 .ssh
-rw——- 1 root root 10174 Jul 3 19:08 .viminfo
-rw-r–r– 1 root root 165 Jul 1 09:26 .wget-hsts
-rw-r–r– 1 root root 3948 Jun 23 04:17 .zshrc
root@bpi-iot-jsho-borg-01:~# cd .config
root@bpi-iot-jsho-borg-01:~/.config# ls -la
total 32
drwx—— 8 root root 4096 Jul 1 12:44 .
drwx—— 6 root root 4096 Jul 4 19:13 ..
drwxr-xr-x 2 root root 4096 Jun 23 04:15 autostart
drwx—— 4 root root 4096 Jul 5 13:02 borg
drwxr-xr-x 2 root root 4096 Jun 23 04:15 htop
drwx—— 2 root root 4096 Jul 1 12:44 procps
drwx—— 2 root root 4096 Jul 1 10:32 pulse
drwxr-xr-x 4 root root 4096 Jun 23 04:15 xfce4
root@bpi-iot-jsho-borg-01:~/.config# cd borg
root@bpi-iot-jsho-borg-01:~/.config/borg# ls -la
total 16
drwx—— 4 root root 4096 Jul 5 13:02 .
drwx—— 8 root root 4096 Jul 1 12:44 ..
drwx—— 2 root root 4096 Jul 5 13:02 keys
drwx—— 4 root root 4096 Jul 5 13:02 security
root@bpi-iot-jsho-borg-01:~/.config/borg# cd keys
root@bpi-iot-jsho-borg-01:~/.config/borg/keys# ls -la
total 12
drwx—— 2 root root 4096 Jul 5 13:02 .
drwx—— 4 root root 4096 Jul 5 13:02 ..
-rw——- 1 root root 553 Jul 5 13:02 bpi_iot_jsho_borg_02__borgbackup_data
root@bpi-iot-jsho-borg-01:~/.config/borg/keys#
How can I specify the encryption passphrase programmatically – using keyfile-based encryption with a blank passphrase so it is possible to encrypt your repository in keyfile mode instead of the default repokey mode and use a blank passphrase for the key file (simply press Enter twice when borg init asks for the password)