backintime - Man Page

Local

Store snapshots on local HDD's (internal or USB). The drive has to be mounted before creating a new snapshot.

Local encrypted

Store encrypted snapshots on local HDD's (internal or USB). Back In Time uses 'encfs' with standard configuration to encrypt all data. Please take a look at A NOTE ON SECURITY.

SSH

With Mode set to SSH you can store the backup on a remote host using the SecureShellHost protocol (ssh). The remote path will be mount local using sshfs to provide file-access for the graphical interface and the backup process. Rsync and other processes called during backup process will run directly on the remote host using ssh.

To prepare your user account for ssh-mode you have to create a password-less login to the remote host (for further information look at http://www.debian-administration.org/articles/152). Type in terminal 'ssh-keygen -t rsa' hit enter for default path and enter a passphrase for the private key.

Finally type 'ssh-copy-id -i ~/.ssh/id_rsa.pub <REMOTE_USER>@<HOST>' and enter your password on remote host.

In Settingsdialog you need to set the host and remote user. If you enter a relative path (no leading / ) it will start from remote users homedir. The password has to be the passphrase for your private key.

Cipher (the algorithm used to encrypt the data during transfer)
To optimize performance you can choose the cipher used by ssh. Depending on your environment you can have a massive speed increase compared to the default cipher.

benchmark-cipher will give you an overview over which cipher is the fastest in your environment.

If the bottleneck of your environment is the hard-drive or the network you will not see a big difference between the ciphers. In this case you should rather stay on 'default'.

Please read security information about the cipher before using them in untrusted networks (Wifi, Internet). Some of them (Arcfour, 3DES, ...) should be handled as not secure anymore.

Remote Host
If your remote host is an embedded Linux NAS or any other device with limited functions, you could run into some problems caused by feature-less commands. For example some devices may not have hardlink support for 'cp', 'chmod' and 'rsync'. In this case it may help to install so-called Optware or Entware on your device if available.

WARNING: THIS IS ONLY FOR EXPERIENCED USERS!
If you don't know how to compile packages and how to modify a Linux system you should NOT try to do this. There is a significant chance to break your device and make it completely unusable with the following procedure. We will not take any warranty for this. Make a backup of your device before proceed! You have been warned!

You should install at least packages called 'bash', 'coreutils' and 'rsync'. You will have to change users default shell from '/bin/sh' to '/opt/bin/bash' in '/etc/passwd'. To add '/opt/bin:/opt/sbin:' to the start of the PATH environment you can use 'Add prefix to SSH commands' in 'Expert Options' with 'PATH=/opt/bin:/opt/sbin:\$PATH'.

To check if it does work you can compare the output of '/bin/cp --help' and '/opt/bin/cp --help'. If 'ssh <user>@<host> cp --help' called from your PC will print the same as '/opt/bin/cp --help' called on the remote host (via interactive ssh session) you are ready to go.

If you have questions on how to install and configure the Optware please refer to the community of your device. You can also take a look on Back In Time FAQ on GitHub https://github.com/bit-team/backintime/blob/-/FAQ.md

If you successfully modified your device to be able to make backups over ssh, it would be nice if you write a 'How to' on Launchpad's Answers so we can add this to the FAQ.

SSH encrypted

Store encrypted snapshots on remote hosts using SSH. Backintime uses 'encfs --reverse' to mount the root filesystem '/'. Rsync will sync this encrypted view of '/' to a remote host over SSH. All encoding will be done on the local machine. So the password will never be exposed to the remote host and you can use the (normally) more powerful processor in you local machine for encryption instead of weak NAS CPU's. The downside on this is 'encfs --reverse' does not support 'Filename Initialization Vector Chaining' and 'Per-File Initialization Vectors' from the standard configuration (take a look at 'man encfs' for further information). Please take a look at A NOTE ON SECURITY.

Because of all data is transferred encrypted the log output shows encrypted filenames, too. In the Logview-Dialog you can use 'decode' option to decrypt the paths automatically or you can use 'backintime decode' to manually decrypt paths. Back In Time will show all snapshots decoded so you can browse all files as normal.

Exclude does not support wildcards ('foo*', '[fF]oo', 'fo?') because after encoding a file these wildcards can't match any more. Only separate asterisk that match a full file or folder will work ('foo/*', 'foo/**/bar'). All other excludes that have wildcards will be silently ignored.

Please refer to the 'SSH' section above for information on setting up the SSH connection.

If 'Save Password to Keyring' is activated Back In Time will save the Password into GnomeKeyring (Seahorse) or KDE-KWallet. Both are secure password storages which encrypt the password with the users login-password. So they can only be accessed if the user is logged in.

A backup cronjob during the user isn't logged in can not collect the password from keyring. Also if the homedir is encrypted the keyring is not accessible from cronjobs (even if the user is logged in). For these cases the password can be cached in RAM. If 'Cache Password for Cron' is activated Back In Time will start a small daemon in user-space which will collect the password from keyring and provide them for cronjobs. They will never be written to the harddrive but a user with root permissions could access the daemon and read the password.

During backup process the application can call a user callback at different steps. This callback is "$XDG_CONFIG_HOME/backintime/user-callback" (by default $XDG_CONFIG_HOME is ~/.config).

The first argument is the profile id (1=Main Profile, ...).

The second argument is the profile name.

The third argument is the reason:

1. Backup process begins.
2. Backup process ends.
3. A new snapshot was taken. The extra arguments are snapshot ID and snapshot path.

4. There was an error. The second argument is the error code.

   Error codes:

   1. The application is not configured.
   2. A "take snapshot" process is already running.
   3. Can't find snapshots folder (is it on a removable drive ?).
   4. A snapshot for "now" already exist.
5. On (graphical) App start.
6. On (graphical) App close.
7. Mount all necessary drives.
8. Unmount all drives.