mirror of
https://github.com/borgbackup/borg.git
synced 2026-10-12 02:11:36 +00:00
Thomas WaldmannandClaude Fable 5.1
abfc4fdf62
The hash function that names store objects (packs/, index/, keys/, locks/), that is appended as a checksum to cache/checked-packs and the reference caches, and that names keyfiles and the files cache suffix, is now defined in exactly one place: store_hash() in crypto/key.py, together with STORE_HASH_NAME (its name for borgstore) and STORE_HASH_SIZE. Every user calls store_hash(data).digest() or .hexdigest() and refers to it as the "store hash" in code comments and docs, so the hash function can be changed there without touching anything else. The tests use store_hash() as well. The docs state which hash function it is (blake3) in one place, the store hash section of data-structures.rst, and refer to it by that name everywhere else. Co-Authored-By: Claude Fable 5.1 <[email protected]>
85 lines
3.1 KiB
ReStructuredText
85 lines
3.1 KiB
ReStructuredText
.. include:: key_change-location.rst.inc
|
|
|
|
.. _borg-change-passphrase:
|
|
|
|
.. include:: key_change-passphrase.rst.inc
|
|
|
|
Examples
|
|
~~~~~~~~
|
|
::
|
|
|
|
# Create a key file protected repository
|
|
$ borg repo-create --encryption=aes256-ocb --key-location=keyfile -v
|
|
Initializing repository at "/path/to/repo"
|
|
Enter new passphrase:
|
|
Enter same passphrase again:
|
|
Do you want your passphrase to be displayed for verification? [yN]: n
|
|
Remember your passphrase. Your data will be inaccessible without it.
|
|
Key in "/root/.config/borg/keys/f23b5f0703c06dc7d9d889b5867496d8cb8ef5b42a5005221d3c7373ec6d6353" created.
|
|
Keep this key safe. Your data will be inaccessible without it.
|
|
...
|
|
|
|
# Change key file passphrase
|
|
$ borg key change-passphrase -v
|
|
Enter passphrase for key /root/.config/borg/keys/f23b5f0703c06dc7d9d889b5867496d8cb8ef5b42a5005221d3c7373ec6d6353:
|
|
Enter new passphrase:
|
|
Enter same passphrase again:
|
|
Do you want your passphrase to be displayed for verification? [yN]: n
|
|
Remember your passphrase. Your data will be inaccessible without it.
|
|
Key updated
|
|
Key location: /root/.config/borg/keys/4881c2f73d9f173bd4c4d30a9f397a596bc742bfa1f652fac3f83cee3f26cb00
|
|
|
|
.. note::
|
|
|
|
Automatically placed key files are named after the :ref:`store hash <store_hash>` of their own
|
|
contents, not after the repository directory name. Because changing the
|
|
passphrase re-encrypts the key, the key file is rewritten under a new name and
|
|
the previous one is removed — that is why the two paths above differ. Use
|
|
``BORG_KEY_FILE`` if you want to choose the key file name yourself.
|
|
|
|
The key file paths shown above are the defaults for Linux (``~/.config/borg/keys/``).
|
|
On macOS, key files are stored in ``~/Library/Application Support/borg/keys/``.
|
|
On Windows, they are stored in ``C:\Users\<user>\AppData\Roaming\borg\keys\``.
|
|
See :ref:`env_vars` for details.
|
|
|
|
::
|
|
|
|
# Import a previously-exported key into a key file, using BORG_KEY_FILE to
|
|
# choose the output key file (creating or overwriting it).
|
|
# --key-location=keyfile is required: "borg key import" defaults to
|
|
# --key-location=repokey, which stores the key in the repository and
|
|
# ignores BORG_KEY_FILE.
|
|
$ BORG_KEY_FILE=/path/to/output-key borg key import --key-location=keyfile /path/to/exported
|
|
|
|
Fully automated using environment variables:
|
|
|
|
::
|
|
|
|
$ BORG_NEW_PASSPHRASE=old borg repo-create --encryption=aes256-ocb
|
|
# now "old" is the current passphrase.
|
|
$ BORG_PASSPHRASE=old BORG_NEW_PASSPHRASE=new borg key change-passphrase
|
|
# now "new" is the current passphrase.
|
|
|
|
|
|
.. include:: key_export.rst.inc
|
|
|
|
Examples
|
|
~~~~~~~~
|
|
::
|
|
|
|
borg key export > encrypted-key-backup
|
|
borg key export --paper > encrypted-key-backup.txt
|
|
borg key export --qr-html > encrypted-key-backup.html
|
|
# Or pass the output file as an argument instead of redirecting stdout:
|
|
borg key export encrypted-key-backup
|
|
borg key export --paper encrypted-key-backup.txt
|
|
borg key export --qr-html encrypted-key-backup.html
|
|
|
|
.. include:: key_import.rst.inc
|
|
|
|
.. include:: key_add.rst.inc
|
|
|
|
.. include:: key_list.rst.inc
|
|
|
|
.. include:: key_remove.rst.inc
|