Encrypt backups¶
Percona XtraBackup supports encrypting and decrypting local and streaming backups with the upstream option, adding another protection layer. The
encryption is implemented using the libgcrypt library from GnuPG.
Create encrypted backups¶
The following options create encrypted backups. The
--encrypt-key and --encrypt-key-file options specify the encryption key and are mutually exclusive. You should select one or the other.
-
--encrypt -
--encrypt-key -
--encrypt-key-file
For an encryption key, use a command, such as openssl rand -base64 24, to generate a random alphanumeric string.
The --encrypt-key option¶
An example of the xtrabackup command using the --encrypt-key:
$ xtrabackup --backup --encrypt=AES256 --encrypt-key="{randomly-generated-alphanumeric-string}" --target-dir=/data/backup
The --encrypt-key-file option¶
The recommended method uses the command line: echo -n “{randomly-generated-alphanumeric-string}” > /data/backups/keyfile to create the file.
Remember that your text editor can automatically insert a CRLF (end of line) character in the KEYFILE when using the– encrypt-key-file option. This inserted character invalidates the key because the size is wrong.
An example of using the --encrypt-key-file option:
$ xtrabackup --backup --encrypt=AES256 --encrypt-key-file=/data/backups/keyfile --target-dir=/data/backup
Optimize the encryption process¶
Additional encrypted backup options, --encrypt-threads and
--encrypt-chunk-size, can speed up the encryption process.
Use the --encrypt-threads option to enable parallel encryption with multiple threads.
The --encrypt-chunk-size option specifies the size, in bytes, of the working encryption buffer for each encryption thread. The default size is 64K.
Decrypt encrypted backups¶
You can decrypt backups with the xbcrypt binary. The following example encrypts a backup.
You can use the --parallel option and the --decrypt option to decrypt multiple files simultaneously.
$ for i in `find . -iname "*\.xbcrypt"`; do xbcrypt -d --encrypt-key-file=/root/secret_key --encrypt-algo=AES256 < $i > $(dirname $i)/$(basename $i .xbcrypt) && rm $i; done
The following example shows a decryption process.
$ xtrabackup --decrypt=AES256 --encrypt-key="{randomly-generated-alphanumeric-string}" --target-dir=/data/backup/
Percona XtraBackup doesn’t automatically remove the encrypted files. You must remove the \*.xbcrypt files manually.
Prepare encrypted backups¶
After decrypting the backups, prepare the backups with the --prepare option:
$ xtrabackup --prepare --target-dir=/data/backup/
Restore encrypted backups¶
xtrabackup offers the --copy-back option to restore a backup to the server’s datadir:
$ xtrabackup --copy-back --target-dir=/data/backup/
The option copies all the data-related files to the server’s datadir. The server’s my.cnf configuration file determines the location.
You should check the last line of the output for a success message:
Expected output
150318 11:08:13 xtrabackup: completed OK!
Get expert help¶
If you need assistance, visit the community forum for comprehensive and free database knowledge, or contact our Percona Database Experts for professional support and services.