From 7a0b4428e36a0e1fd1b8835927383a97a9dc57e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Antoine=20Beaupr=C3=A9?= Date: Sat, 16 Sep 2017 10:17:36 -0400 Subject: [PATCH 1/2] add explanation of restic automation every time i look at restic, i block on this and figured it may be useful for others --- doc/conf.py | 6 +++++- doc/faq.rst | 20 ++++++++++++++++++++ 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/doc/conf.py b/doc/conf.py index 577b2da00..3f7c66158 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -19,7 +19,7 @@ import os # Add any Sphinx extension module names here, as strings. They can be # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom # ones. -extensions = [] +extensions = ['sphinx.ext.extlinks'] # Add any paths that contain templates here, relative to this directory. templates_path = ['_templates'] @@ -104,3 +104,7 @@ html_static_path = ['_static'] # Output file base name for HTML help builder. htmlhelp_basename = 'resticdoc' + +extlinks = { + 'issue': ('https://github.com/restic/restic/issues/%s', '#'), +} diff --git a/doc/faq.rst b/doc/faq.rst index 185bfd978..4bf2f477f 100644 --- a/doc/faq.rst +++ b/doc/faq.rst @@ -26,3 +26,23 @@ The message means that there is more data stored in the repo than strictly necessary. With high probability this is duplicate data. In order to clean it up, the command ``restic prune`` can be used. The cause of this bug is not yet known. + +How can I specify encryption passwords automatically? +----------------------------------------------------- + +When you run ``restict create``, you need to enter the passphrase on +the console. This is not very convenient for automated backups, so you +can also provide the password through the ``--password-file`` option +or ``RESTIC_PASSWORD`` environment. A discussion is in progress over +implementing unattended backups happens in :issue:`533`. + +.. important:: Be careful how you set the environment; using the env + command, a `system()` call or using inline shell + scripts (e.g. `RESTIC_PASSWORD=password borg ...`) + might expose the credentials in the process list + directly and they will be readable to all users on a + system. Using export in a shell script file should be + safe, however, as the environment of a process is + `accessible only to that user`_. + +.. _accessible only to that user: https://security.stackexchange.com/questions/14000/environment-variable-accessibility-in-linux/14009#14009 From bcd1e45ba7a133df612fc8f380781eb81e956097 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Antoine=20Beaupr=C3=A9?= Date: Mon, 18 Sep 2017 08:55:18 -0400 Subject: [PATCH 2/2] fix typo, add note about file permissions --- doc/faq.rst | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/doc/faq.rst b/doc/faq.rst index 4bf2f477f..b0e8495aa 100644 --- a/doc/faq.rst +++ b/doc/faq.rst @@ -30,7 +30,7 @@ cause of this bug is not yet known. How can I specify encryption passwords automatically? ----------------------------------------------------- -When you run ``restict create``, you need to enter the passphrase on +When you run ``restic backup``, you need to enter the passphrase on the console. This is not very convenient for automated backups, so you can also provide the password through the ``--password-file`` option or ``RESTIC_PASSWORD`` environment. A discussion is in progress over @@ -43,6 +43,9 @@ implementing unattended backups happens in :issue:`533`. directly and they will be readable to all users on a system. Using export in a shell script file should be safe, however, as the environment of a process is - `accessible only to that user`_. + `accessible only to that user`_. Please make sure that + the permissions on the files where the password is + eventually stored are safe (e.g. `0600` and owned by + root). .. _accessible only to that user: https://security.stackexchange.com/questions/14000/environment-variable-accessibility-in-linux/14009#14009