4

I have a Linux machine which I'd like to use as a NAS backup, so I'm following this blog post by Sam Hewitt.

My MacBook's drives are not encrypted with FileVault, and I'm on El Capitan 10.11.5. I am wondering how encryption works when data is backed up to a NAS Time Machine backup. More specifically:

  • If I select the "Encrypt Backups" options in Time Machine Prefs, will my backup be encrypted before being transferred over my network?
  • Is the transfer protocol used by Time Machine secure?
  • Will backups on my remote NAS always be encrypted, unreadable by anyone who can somehow access the machine?
5

First, a warning: unsupported backup targets are unsupported for a reason. I don't know the details, but apparently there's some special sauce (or at least a newer version of the AFP protocol) needed on the server to cleanly handle things like getting disconnected partway through a backup. As a result, backups to unsupported network servers seem to get corrupted more than they should, which isn't good for a backup system.

Now about security: the backup is stored on the server in the form of an encrypted disk image (in sparse bundle format). The image is mounted on the client (your computer), which means that the encryption/decryption takes place on the client, and all that goes over the network (and is seen / stored by the server) is encrypted blocks of the image.

To answer your questions directly:

  • Yes, the backup is encrypted before being sent to the server.
  • No, the AFP protocol is not particularly secure, but it doesn't matter because the data being transferred over AFP is encrypted.
  • Yes, the TM data on the NAS is encrypted.

BTW, be sure to store your backup password somewhere safe -- If your HD dies, and you don't remember the backup encryption password, there'll be no way to get your data back.

  • I'm certainly wary of using an unsupported target, that's why this is merely my second backup method (though I'm not exactly following the '123' rule yet). However in regards to when it might fail, will the "Verifying" step in the backup detect corruption? Or will the backup be corrupted silently? – Lucas Watson Jul 9 '17 at 16:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .