Home / server / Questions / 354069
In Process
Squidly
Asked: 2012-01-27 13:52:17 +0800 CST

Linux LTO-4/5/6 Hardware AES Drive Encryption

  • 772

For a number of reasons I have been trying to find a way to encrypt my backup tapes. I'm currently running Bacula for my backups and it's support for Drive based encryption is I have to call a script or something to set the key in the drive.

How can I set the encryption options on the tape drive in Debian Linux?

backup debian encryption tape lto-4

2 Answers

  1. stenc project should be useful (haven't personally tested that) -- http://sourceforge.net/projects/stenc/

    • 7

  2. I have tested stenc as suggested by sendmoreinfo and it worked well with the LTO-6 drive.

    Usage:

    Insert a tape and ask the tape drive about its settings:

    # stenc -f /dev/nst0 --detail

    Generate your 256 bit key and store it:

    # stenc -g 256 -k /root/myaes.key -kd Bobs_month_key

    Load the key in the LTO tape drive. With --ckod it will forget the key after tape eject.

    # stenc -f /dev/nst0 -e on -k /root/myaes.key -a 1 --ckod

    Verify that the drive enabled AES now:

    # stenc -f /dev/nst0 --detail
Status for /dev/nst0
--------------------------------------------------
Device Mfg:              TANDBERG
Product ID:              LTO-6 HH        
Product Revision:        3519
Drive Encryption:        on
Drive Output:            Decrypting
                         Unencrypted data not outputted
Drive Input:             Encrypting
                         Protecting from raw read
Key Instance Counter:    4
Encryption Algorithm:    1
Drive Key Desc.(uKAD):   Bobs_month_key
Volume Encryption:       Encrypted and able to decrypt
                         Protected from raw read
Volume Algorithm:        1

    I have prepared a package for Gentoo Linux.

    • 5