Re: [Bacula-users] data key rollover strategy

2015-11-28 Thread Devin Reade
--On Thursday, November 19, 2015 01:03:59 PM + Martin Simmons wrote: > Does Bacula ever check for expired [data encryption] certs? I suspect > not, so the question about rollover strategy is a moot one. I've empirically verified this to be the case; I performed a backup using a short-lived

Re: [Bacula-users] data key rollover strategy

2015-11-19 Thread Martin Simmons
> On Thu, 19 Nov 2015 09:15:36 -0700, Devin Reade said: > > > Some time ago I prepared a few diagrams that show Bacula data > > encryption algorighm. Here are the diagrams in English version: > > > > http://www.bacula.pl/data_encryption.html > > That diagram is a bit simplified in that it imp

Re: [Bacula-users] data key rollover strategy

2015-11-19 Thread Devin Reade
--On Thursday, November 19, 2015 10:49:07 AM +0100 Marcin Haba wrote: > You can renew your certs. True, as long as you're ok with using the old key. However t won't work, for example, if you need to expand your key size. > I think that important is understand that data stored by Bacula is not

Re: [Bacula-users] data key rollover strategy

2015-11-19 Thread Heitor Faria
>> On Wed, 18 Nov 2015 16:17:20 -0700, Devin Reade said: >> >> My alerting system tells me that I have some file daemons that have been >> merrily encrypting their data for quite a while. In particular, the >> expiry dates for the data encryption x509 certs are coming up soon. >> >> Well, t

Re: [Bacula-users] data key rollover strategy

2015-11-19 Thread Martin Simmons
> On Wed, 18 Nov 2015 16:17:20 -0700, Devin Reade said: > > My alerting system tells me that I have some file daemons that have been > merrily encrypting their data for quite a while. In particular, the > expiry dates for the data encryption x509 certs are coming up soon. > > Well, this brin

Re: [Bacula-users] data key rollover strategy

2015-11-19 Thread Marcin Haba
Hello Devin, 2015-11-19 0:17 GMT+01:00 Devin Reade : > My alerting system tells me that I have some file daemons that have been > merrily encrypting their data for quite a while. In particular, the > expiry dates for the data encryption x509 certs are coming up soon. You can renew your certs. I

[Bacula-users] data key rollover strategy

2015-11-18 Thread Devin Reade
My alerting system tells me that I have some file daemons that have been merrily encrypting their data for quite a while. In particular, the expiry dates for the data encryption x509 certs are coming up soon. Well, this brings up an interesting question that I'd not really considered in depth: G