Update the backup documentation

doc/EN/backups.org

@@ -11,12 +11,24 @@
 #+BEGIN_CENTER
 #+ATTR_HTML: :border -1
 | [[file:index.html][Home]]                  |
+| [[Backup keys]]           |
 | [[Backup to USB]]         |
 | [[Restore from USB]]      |
 | [[Distributed backups]]   |
 | [[Restore from a friend]] |
 #+END_CENTER
 
+* Backup keys
+As part of the Freedombone installation the GPG key used to encrypt backups will have been added to the /.gnupg/ keyring in your home directory. Ensure that you have a copy of all your keys by plugging in a LUKS encrypted USB drive and then running the command:
+
+#+BEGIN_SRC bash
+ssh username@domainname -p 2222
+freedombone-keydrive -u [username] --master
+#+END_SRC
+
+Keep this USB drive in some safe place, since it will enable you to restore from previous backups.
+
+A pro-tip for the best possible security is to create multiple USB drives containing key fragments, and then to distribute them amongst your friends. In the worst case just ask for the drives back and you'll be able to reconstruct the backup key. You can do this by ommitting the /--master/ option in the above command and then repeating the process with a number of different USB drives (typically 4 or more).
 * Backup to USB
 First and foremost - *encrypt your USB drives*! Even if you think you have "/nothing to hide/" if you accidentally lose a USB thumb drive (it's easy to lose small objects) and it's not encrypted then potentially someone might be able to obtain enough information about you to commit identity fraud, take out loans, open bank accounts, etc. Use LUKS encryption. In Ubuntu you can do this using the /Disk Utility/ application. Some instructions [[https://help.ubuntu.com/community/EncryptedFilesystemsOnRemovableStorage][can be found here]].
 
@@ -30,47 +42,43 @@ su
 backup
 #+END_SRC
 
-Type in the password for the USB drive, then if this is the first time that you've made a backup then you will be prompted for your GPG key passphrase.
+Type in the password for the USB drive, then the backup will begin.
 
 When the backup ends remove the USB drive and keep it somewhere safe. Even if it gets lost or falls into the wrong hands the content is encrypted and so is unlikely to become a source of leaks.
 * Restore from USB
-Insert the USB thumb drive containing your backup into the front socket of the Beaglebone Black.
-
-Log into the system and become the root user, then run the /restore/ command.
+Log into the system and become the root user:
 
 #+BEGIN_SRC bash
 ssh username@domainname -p 2222
 su
-restore
 #+END_SRC
 
-Enter the password for the USB drive, then you will be prompted to enter your GPG key passphrase. When the restore is complete you can remove the USB drive.
-* Distributed backups
-Distributed backups are a better way of ensuring the persistence of your data, such that even if your system gets stolen or destroyed then the data will still be recoverable from your friends. Since the backups are encrypted your friends (or anyone else with access to their systems) won't be able to read your backed up content even if their systems are subsequently compromised.
-
-Firstly you will need to have a user account on one or more of your friends servers.  They don't necessarily need to be using Freedombone, just some version of GNU/Linux with ssh access.  They can create a user account for you with the *adduser <username>* command when logged in as root and then give you the username and password via a secure method, such as on paper or via an encrypted email or via an XMPP chat using OTR. Make sure that the password used is a strong one - preferably a long random string stored in a password manager - so that dictionary attacks will fail. Also for maximum resilience put your password manager file onto a USB thumb drive and carry it with you.
+If this is a new Freedombone installation then you will first need to restore your backup keys. That can be done as follows:
 
 #+BEGIN_SRC bash
-ssh username@domainname -p 2222
-freedombone-remote
+freedombone-recoverkey -u [username] --master
 #+END_SRC
 
-You can then enter the usernames, domains and ssh logins for one or more remote servers. The system will try to backup to these remote locations once per day.
+Insert the USB thumb drive containing your backup into the front socket of the Beaglebone Black.
 
-Very important is to take a copy of the contents of *backup.key*.
+Log into the system and become the root user, then run the /restore/ command.
 
 #+BEGIN_SRC bash
-su
-cat /etc/ssl/private/backup.key
+restore
 #+END_SRC
 
-If the backup key doesn't yet exist then you can manually create it with:
+Enter the password for the USB drive. When the restore is complete you can remove the USB drive.
+* Distributed backups
+Distributed backups are a better way of ensuring the persistence of your data, such that even if your system gets stolen or destroyed then the data will still be recoverable from your friends. Since the backups are encrypted your friends (or anyone else with access to their systems) won't be able to read your backed up content even if their systems are subsequently compromised.
+
+Firstly you will need to have a user account on one or more of your friends servers.  They don't necessarily need to be using Freedombone, just some version of GNU/Linux with ssh access.  They can create a user account for you with the *adduser <username>* command when logged in as root and then give you the username and password via a secure method, such as on paper or via an encrypted email or via an XMPP chat using OTR. Make sure that the password used is a strong one - preferably a long random string stored in a password manager - so that dictionary attacks not be easy. Also for maximum resilience put your password manager file onto a USB thumb drive and carry it with you.
 
 #+BEGIN_SRC bash
-freedombone-addcert -h backup
+ssh username@domainname -p 2222
+freedombone-remote
 #+END_SRC
 
-Store it within a password manager on a USB drive which you carry with you. In the worst case scenario you'll be able to restore your system on completely new hardware if you have this key, so long as at least one of your friends servers is accessable via ssh.
+You can then enter the usernames, domains and ssh logins for one or more remote servers. The system will try to backup to these remote locations once per day.
 * Restore from a friend
 ** With a completely new Freedombone installation
 This is the ultimate disaster recovery scenario in which you are beginning completely from scratch with new hardware and a new Freedombone installation (configured with the same username and domain names). It is assumed that the old hardware was destroyed, but that you have the backup key stored within a password manager on a USB thumb drive.
@@ -84,18 +92,14 @@ freedombone-remote
 
 Configure the remote server login details.
 
-Now log in as root and restore the backup key which you have in your password manager.
+Now plug in the USB drive containing the backup key and restore it.
 
 #+BEGIN_SRC bash
 su
-editor /etc/ssl/private/backup.key
+freedombone-recoverkey -u [username] --master
 #+END_SRC
 
-Paste in the backup key, then save and exit.
-
-#+BEGIN_SRC bash
-chmod 600 /etc/ssl/private/backup.key
-#+END_SRC
+If you are recovering from multiple USB drives containing key fragments then just ommit the /--master/ option in the above command.
 
 Then use the command:
 

website/EN/backups.html

@@ -4,7 +4,7 @@
 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
 <head>
 <title></title>
-<!-- 2015-07-05 Sun 20:29 -->
+<!-- 2015-09-29 Tue 10:21 -->
 <meta  http-equiv="Content-Type" content="text/html;charset=utf-8" />
 <meta  name="generator" content="Org-mode" />
 <meta  name="author" content="Bob Mottram" />
@@ -175,134 +175,155 @@ for the JavaScript code in this tag.
 </tr>
 
 <tr>
-<td class="org-left"><a href="#orgheadline1">Backup to USB</a></td>
+<td class="org-left"><a href="#orgheadline1">Backup keys</a></td>
 </tr>
 
 <tr>
-<td class="org-left"><a href="#orgheadline2">Restore from USB</a></td>
+<td class="org-left"><a href="#orgheadline2">Backup to USB</a></td>
 </tr>
 
 <tr>
-<td class="org-left"><a href="#orgheadline3">Distributed backups</a></td>
+<td class="org-left"><a href="#orgheadline3">Restore from USB</a></td>
 </tr>
 
 <tr>
-<td class="org-left"><a href="#orgheadline4">Restore from a friend</a></td>
+<td class="org-left"><a href="#orgheadline4">Distributed backups</a></td>
+</tr>
+
+<tr>
+<td class="org-left"><a href="#orgheadline5">Restore from a friend</a></td>
 </tr>
 </tbody>
 </table>
 </div>
 
 <div id="outline-container-orgheadline1" class="outline-2">
-<h2 id="orgheadline1">Backup to USB</h2>
+<h2 id="orgheadline1">Backup keys</h2>
 <div class="outline-text-2" id="text-orgheadline1">
 <p>
-First and foremost - <b>encrypt your USB drives</b>! Even if you think you have "<i>nothing to hide</i>" if you accidentally lose a USB thumb drive (it's easy to lose small objects) and it's not encrypted then potentially someone might be able to obtain enough information about you to commit identity fraud, take out loans, open bank accounts, etc. Use LUKS encryption. In Ubuntu you can do this using the <i>Disk Utility</i> application. Some instructions <a href="https://help.ubuntu.com/community/EncryptedFilesystemsOnRemovableStorage">can be found here</a>.
-</p>
-
-<p>
-Insert a USB thumb drive into the front socket of the Beaglebone Black.
-</p>
-
-<p>
-Log into the system and become the root user, then run the <i>backup</i> command.
+As part of the Freedombone installation the GPG key used to encrypt backups will have been added to the <i>.gnupg</i> keyring in your home directory. Ensure that you have a copy of all your keys by plugging in a LUKS encrypted USB drive and then running the command:
 </p>
 
 <div class="org-src-container">
 
 <pre class="src src-bash">ssh username@domainname -p 2222
-su
-backup
+freedombone-keydrive -u [username] --master
 </pre>
 </div>
 
 <p>
-Type in the password for the USB drive, then if this is the first time that you've made a backup then you will be prompted for your GPG key passphrase.
+Keep this USB drive in some safe place, since it will enable you to restore from previous backups.
 </p>
 
 <p>
-When the backup ends remove the USB drive and keep it somewhere safe. Even if it gets lost or falls into the wrong hands the content is encrypted and so is unlikely to become a source of leaks.
+A pro-tip for the best possible security is to create multiple USB drives containing key fragments, and then to distribute them amongst your friends. In the worst case just ask for the drives back and you'll be able to reconstruct the backup key. You can do this by ommitting the <i>&#x2013;master</i> option in the above command and then repeating the process with a number of different USB drives (typically 4 or more).
 </p>
 </div>
 </div>
 <div id="outline-container-orgheadline2" class="outline-2">
-<h2 id="orgheadline2">Restore from USB</h2>
+<h2 id="orgheadline2">Backup to USB</h2>
 <div class="outline-text-2" id="text-orgheadline2">
 <p>
-Insert the USB thumb drive containing your backup into the front socket of the Beaglebone Black.
+First and foremost - <b>encrypt your USB drives</b>! Even if you think you have "<i>nothing to hide</i>" if you accidentally lose a USB thumb drive (it's easy to lose small objects) and it's not encrypted then potentially someone might be able to obtain enough information about you to commit identity fraud, take out loans, open bank accounts, etc. Use LUKS encryption. In Ubuntu you can do this using the <i>Disk Utility</i> application. Some instructions <a href="https://help.ubuntu.com/community/EncryptedFilesystemsOnRemovableStorage">can be found here</a>.
 </p>
 
 <p>
-Log into the system and become the root user, then run the <i>restore</i> command.
+Insert a USB thumb drive into the front socket of the Beaglebone Black.
+</p>
+
+<p>
+Log into the system and become the root user, then run the <i>backup</i> command.
 </p>
 
 <div class="org-src-container">
 
 <pre class="src src-bash">ssh username@domainname -p 2222
 su
-restore
+backup
 </pre>
 </div>
 
 <p>
-Enter the password for the USB drive, then you will be prompted to enter your GPG key passphrase. When the restore is complete you can remove the USB drive.
+Type in the password for the USB drive, then the backup will begin.
+</p>
+
+<p>
+When the backup ends remove the USB drive and keep it somewhere safe. Even if it gets lost or falls into the wrong hands the content is encrypted and so is unlikely to become a source of leaks.
 </p>
 </div>
 </div>
 <div id="outline-container-orgheadline3" class="outline-2">
-<h2 id="orgheadline3">Distributed backups</h2>
+<h2 id="orgheadline3">Restore from USB</h2>
 <div class="outline-text-2" id="text-orgheadline3">
 <p>
-Distributed backups are a better way of ensuring the persistence of your data, such that even if your system gets stolen or destroyed then the data will still be recoverable from your friends. Since the backups are encrypted your friends (or anyone else with access to their systems) won't be able to read your backed up content even if their systems are subsequently compromised.
+Log into the system and become the root user:
 </p>
 
+<div class="org-src-container">
+
+<pre class="src src-bash">ssh username@domainname -p 2222
+su
+</pre>
+</div>
+
 <p>
-Firstly you will need to have a user account on one or more of your friends servers.  They don't necessarily need to be using Freedombone, just some version of GNU/Linux with ssh access.  They can create a user account for you with the <b>adduser &lt;username&gt;</b> command when logged in as root and then give you the username and password via a secure method, such as on paper or via an encrypted email or via an XMPP chat using OTR. Make sure that the password used is a strong one - preferably a long random string stored in a password manager - so that dictionary attacks will fail. Also for maximum resilience put your password manager file onto a USB thumb drive and carry it with you.
+If this is a new Freedombone installation then you will first need to restore your backup keys. That can be done as follows:
 </p>
 
 <div class="org-src-container">
 
-<pre class="src src-bash">ssh username@domainname -p 2222
-freedombone-remote
+<pre class="src src-bash">freedombone-recoverkey -u [username] --master
 </pre>
 </div>
 
 <p>
-You can then enter the usernames, domains and ssh logins for one or more remote servers. The system will try to backup to these remote locations once per day.
+Insert the USB thumb drive containing your backup into the front socket of the Beaglebone Black.
 </p>
 
 <p>
-Very important is to take a copy of the contents of <b>backup.key</b>.
+Log into the system and become the root user, then run the <i>restore</i> command.
 </p>
 
 <div class="org-src-container">
 
-<pre class="src src-bash">su
-cat /etc/ssl/private/backup.key
+<pre class="src src-bash">restore
 </pre>
 </div>
 
 <p>
-If the backup key doesn't yet exist then you can manually create it with:
+Enter the password for the USB drive. When the restore is complete you can remove the USB drive.
+</p>
+</div>
+</div>
+<div id="outline-container-orgheadline4" class="outline-2">
+<h2 id="orgheadline4">Distributed backups</h2>
+<div class="outline-text-2" id="text-orgheadline4">
+<p>
+Distributed backups are a better way of ensuring the persistence of your data, such that even if your system gets stolen or destroyed then the data will still be recoverable from your friends. Since the backups are encrypted your friends (or anyone else with access to their systems) won't be able to read your backed up content even if their systems are subsequently compromised.
+</p>
+
+<p>
+Firstly you will need to have a user account on one or more of your friends servers.  They don't necessarily need to be using Freedombone, just some version of GNU/Linux with ssh access.  They can create a user account for you with the <b>adduser &lt;username&gt;</b> command when logged in as root and then give you the username and password via a secure method, such as on paper or via an encrypted email or via an XMPP chat using OTR. Make sure that the password used is a strong one - preferably a long random string stored in a password manager - so that dictionary attacks not be easy. Also for maximum resilience put your password manager file onto a USB thumb drive and carry it with you.
 </p>
 
 <div class="org-src-container">
 
-<pre class="src src-bash">freedombone-addcert -h backup
+<pre class="src src-bash">ssh username@domainname -p 2222
+freedombone-remote
 </pre>
 </div>
 
 <p>
-Store it within a password manager on a USB drive which you carry with you. In the worst case scenario you'll be able to restore your system on completely new hardware if you have this key, so long as at least one of your friends servers is accessable via ssh.
+You can then enter the usernames, domains and ssh logins for one or more remote servers. The system will try to backup to these remote locations once per day.
 </p>
 </div>
 </div>
-<div id="outline-container-orgheadline4" class="outline-2">
-<h2 id="orgheadline4">Restore from a friend</h2>
-<div class="outline-text-2" id="text-orgheadline4">
-</div><div id="outline-container-orgheadline5" class="outline-3">
-<h3 id="orgheadline5">With a completely new Freedombone installation</h3>
-<div class="outline-text-3" id="text-orgheadline5">
+<div id="outline-container-orgheadline5" class="outline-2">
+<h2 id="orgheadline5">Restore from a friend</h2>
+<div class="outline-text-2" id="text-orgheadline5">
+</div><div id="outline-container-orgheadline6" class="outline-3">
+<h3 id="orgheadline6">With a completely new Freedombone installation</h3>
+<div class="outline-text-3" id="text-orgheadline6">
 <p>
 This is the ultimate disaster recovery scenario in which you are beginning completely from scratch with new hardware and a new Freedombone installation (configured with the same username and domain names). It is assumed that the old hardware was destroyed, but that you have the backup key stored within a password manager on a USB thumb drive.
 </p>
@@ -323,26 +344,20 @@ Configure the remote server login details.
 </p>
 
 <p>
-Now log in as root and restore the backup key which you have in your password manager.
+Now plug in the USB drive containing the backup key and restore it.
 </p>
 
 <div class="org-src-container">
 
 <pre class="src src-bash">su
-editor /etc/ssl/private/backup.key
+freedombone-recoverkey -u [username] --master
 </pre>
 </div>
 
 <p>
-Paste in the backup key, then save and exit.
+If you are recovering from multiple USB drives containing key fragments then just ommit the <i>&#x2013;master</i> option in the above command.
 </p>
 
-<div class="org-src-container">
-
-<pre class="src src-bash">chmod 600 /etc/ssl/private/backup.key
-</pre>
-</div>
-
 <p>
 Then use the command:
 </p>
@@ -354,9 +369,9 @@ Then use the command:
 </div>
 </div>
 </div>
-<div id="outline-container-orgheadline6" class="outline-3">
-<h3 id="orgheadline6">On an existing Freedombone installation</h3>
-<div class="outline-text-3" id="text-orgheadline6">
+<div id="outline-container-orgheadline7" class="outline-3">
+<h3 id="orgheadline7">On an existing Freedombone installation</h3>
+<div class="outline-text-3" id="text-orgheadline7">
 <p>
 This is for more common situations in which maybe some data became corrupted and you want to restore it.
 </p>