1 <?xml version="1.0" encoding="ISO-8859-1"?>
2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd"
5 <!-- entities files to use -->
6 <!ENTITY % global_entities SYSTEM 'global.entities'>
10 <refentry id='amcrypt-asym-ossl.8'>
13 <refentrytitle>amcrypt-ossl-asym</refentrytitle>
14 <manvolnum>8</manvolnum>
20 <refname>amcrypt-ossl-asym</refname>
21 <refpurpose>crypt program for Amanda asymmetric data encryption using OpenSSL</refpurpose>
26 <!-- body begins here -->
29 <command>amcrypt-ossl-asym</command>
30 <arg choice="opt">-d</arg>
34 <title>DESCRIPTION</title>
36 &amcryptosslasym; uses <emphasis remap='B'>OpenSSL</emphasis> to
37 encrypt and decrypt data. OpenSSL is available from <ulink
38 url="http://www.openssl.org/">www.openssl.org</ulink>. OpenSSL
39 offers a wide variety of cipher choices (&amcryptosslasym; defaults
40 to 256-bit AES) and can use hardware cryptographic accelerators on
44 &amcryptosslasym; will search for the OpenSSL program in the following
45 directories: /bin:/usr/bin:/usr/local/bin:/usr/ssl/bin:/usr/local/ssl/bin.
49 <title>GENERATING PUBLIC AND PRIVATE KEYS</title>
51 RSA keys can be generated with the standard OpenSSL commands, e.g.:
55 $ openssl genrsa -aes128 -out backup-privkey.pem 1024
56 Generating RSA private key, 1024 bit long modulus
58 Enter pass phrase for backup-privkey.pem: <emphasis remap='I'>ENTER YOUR PASS PHRASE</emphasis>
59 Verifying - Enter pass phrase for backup-key.pem: <emphasis remap='I'>ENTER YOUR PASS PHRASE</emphasis>
61 $ openssl rsa -in backup-privkey.pem -pubout -out backup-pubkey.pem
62 Enter pass phrase for backup-privkey.pem: <emphasis remap='I'>ENTER YOUR PASS PHRASE</emphasis>
67 To generate a private key without a passphrase, omit the
68 <option>-aes128</option> option. See
69 <manref name="openssl_genrsa" vol="1"/>
70 for more key generation options.
73 Note that it is always possible to generate the public key from the
78 <title>KEY AND PASSPHRASE MANAGEMENT</title>
80 &amcryptosslasym; uses the <emphasis remap='I'>public key</emphasis>
81 to encrypt data. The security of the data does not depend on the
82 confidentiality of the public key. The <emphasis remap='I'>private
83 key</emphasis> is used to decrypt data, and must be protected.
84 Encrypted backup data cannot be recovered without the private key.
85 The private key may optionally be encrypted with a passphrase.
88 While the public key must be online at all times to perorm backups,
89 the private key and optional passphrase are only needed to restore
90 data. It is recommended that the latter be stored offline all other
91 times. For example, you could keep the private key on removable media,
92 and copy it into place for a restore; or you could keep the private
93 key online, encrypted with a passphrase that is present only for a
97 OpenSSL's key derivation routines use a salt to guard against
98 dictionary attacks on the pass phrase; still it is important to pick
99 a pass phrase that is hard to guess. The Diceware method (see <ulink
100 url="http://www.diceware.com/">www.diceware.com</ulink>) can
101 be used to create passphrases that are difficult to guess and easy to
107 <variablelist remap='TP'>
109 <term>/var/lib/amanda/backup-privkey.pem</term>
112 File containing the RSA private key. It should not be readable
113 by any user other than the Amanda user.
118 <term>/var/lib/amanda/backup-pubkey.pem</term>
121 File containing the RSA public key.
126 <term>/var/lib/amanda/.am_passphrase</term>
129 File containing the passphrase. It should not be readable by
130 any user other than the Amanda user.
138 <manref name="amanda.conf" vol="5"/>,
139 <manref name="openssl" vol="1"/>,
140 <manref name="amcrypt-ossl" vol="8"/>