7

I have three relevant machines:

  • An iMac running 10.10 as my Time Machine server.
  • A MacBook Pro running 10.10, which backs up to the server. Backup encryption is enabled.
  • A PowerBook G4 running 10.5, which also backs up to the server. Backup encryption is not supported by 10.5.

In the case of the 10.10 MacBook, I understand that setting the MacBook to encrypt backups means that the backups stored on the server will be in an encrypted sparse image. However, the data being sent to the server is sent in the clear, unless the client handles encryption (unlikely).

Could the data transfer be secured by SSH for both machines?

  • 1
    When you use a Time Capsule or other networked device to store encrypted backups, your computer (the client) performs the encryption before sending it across, not the Time Capsule or networked device. Do you have reason to believe that anything behaves differently with a Time Machine server? I'm not familiar with that kind of setup, which is why I ask. – user11633 Dec 9 '14 at 20:40
  • @Phong Due to it using AFP, this is not the case. It would just be like reading/writing to an encrypted volume over WebDAV with plain HTTP. The encryption is handled entirely by the filesystem on the server. – andonuts Dec 11 '14 at 3:49
  • 2
    That would be the case if you were writing plain data to an encrypted partition. An encrypted sparse image is not a property of a file system, however, so it's not the same thing. In this situation you're sending an encrypted data stream over an unencrypted transport, although that doesn't address your 10.5 system. – user11633 Dec 11 '14 at 14:26
2

The easiest way to be sure that all your clients' backups are encrypted is to create an encrypted sparse (bundle) image using Leopard (10.5) on the server using hdutil. The newer versions of OSX should be able to read/write to the older encrypted volume without a problem.

Here is an example using a Linux AFP server... http://www.cognizo.com/2012/04/encrypted-network-backups-with-os-x-time-machine/

And another http://bubba.org/wiki/Encrypted_Remote_Backups_with_Sparse_Bundles

This way all data encryption/decryption is done at the client end. Problem sovled.

0

You could use a product like SSHFS that uses MacFUSE, which would mount a directory on the remote SSH server as a filesystem, and all transactions over the wire would be encrypted. You can also use a utility like EncFS which is a file-based loopback encryption layer on top of an existing volume or filesystem like AFP.

I would agree with the above poster -- I'd create and mount a sparse bundle or drive image over the network that is encrypted. From there on out, if it is mounted, anyone watching the network traffic will only see encrypted data going across.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .