Openssl in container

[sascha-schieferdecker]

Would it be possible to include openssl in the image, so we could encrypt the dumps on the fly? I'm thinking of a pre-backup or post-backup script using asymmetric encryption with a public key.

[deitch]

That’s a pretty good idea. Would you need anything else? Or just the OpenSSL cli?

[sascha-schieferdecker]

I built an own image based on your image for testing. I just added the package 'openssl' in my Dockerfile and can do an encryption with a script and public key mounted in /scripts.d/post-backup.

I think that's all that is needed. Let me fine tune my script a little bit more, then I can provide it as an example on how to encrypt a backup with openssl.

[sascha-schieferdecker]

Okay, if there's an openssl binary in the container, you can do an encryption like this.

Generate an openssl key pair:

openssl req -x509 -nodes -newkey rsa:2048 -keyout mysqldump-key.priv.pem -out mysqldump-key.pub.pem

Create these scripts and mount them into the container. For anyone reading this, you have to mount the "post-backup" folder and the "target.sh" as described in the README.

/scripts.d/post-backup/secure.sh

!/bin/bash
# Encrypt and chmod backup file.
if [[ -n "$DB_DUMP_DEBUG" ]]; then
  set -x
fi

if [ -e ${DUMPFILE} ];
then
  openssl smime -encrypt -binary -text -aes256 -in ${DUMPFILE} -out ${DUMPFILE}.enc -outform DER /scripts.d/post-backup/mysqldump-key.pub.pem
  mv ${DUMPFILE}.enc ${DUMPFILE}
  chmod 600 ${DUMPFILE}
else
  echo "ERROR: Backup file ${DUMPFILE} does not exist!"
fi

The public key is also in /scripts.d/post-backup

To set a nicer target filename with ".enc" suffix I added a corresponding target.sh:

#!/bin/bash

# Rename target file
echo -n "db-backup_${NOW}.sql.gz.enc"

Maybe it's possible to pipe the dump through openssl while dumping, that would be better regarding security.

Decrypting the backup can be done using the private key, preferrably on another system:

openssl smime -decrypt -in db-backup_20200115115204.sql.gz.enc -binary -inform DEM -inkey /path/to/private-key/mysqldump-key.priv.pem -out db-backup_20200115115204.sql.gz