BSCRYPTO(8)

💅 BSCRYPTO(8) — okay bestie, let’s talk bscrypto

Welcome to the BSCRYPTO(8) manual page from Backup Archiving REcovery Open Sourced. This is all about bscrypto, aka Bareos’s 'SCSI Crypto'. It’s giving very niche, very powerful, very “trust me, you’ll need this later” energy. ✨

🌸 NAME 🌸

bscrypto — Bareos’s 'SCSI Crypto'

🦋 SYNOPSIS 🦋

bscrypto [options] device_name

🎀 DESCRIPTION 🎀

Okay so the purpose of bscrypto is to be a standalone tool for manipulating the SCSI Crypto framework using the SCSI SPIN/SPOUT security pages. It lets you perform standalone crypto operations that are normally performed by the scsicrypto-sd.so plugin in the storage daemon. 💅

You also need the bscrypto tool to do the initial setup of things like Key Encryption Keys in the bareos-sd and bareos-dir configuration files. No cap, it’s a setup-essential little icon. 🫶

✨ OPTIONS ✨

A summary of options is included below, bestie:

• -? — Show version and usage of program.
• -b — Perform base64 encoding of keydata. Any binary data is base64 encoded and as such converted to normal ASCII.
• -c — Clear encryption key. Clear the encryption key currently loaded on the drive by issuing a SCSI SPOUT clear key page.
• -D <cachefile> — Dump the content of given cachefile.
• -d <nn> — Set debug level to <nn>.
• -e — Show drive encryption status. Request the current drive encryption status by issuing a SCSI SPIN cmd requesting the SPIN_DATA_ENCR_STATUS_PAGE.
• -g <keyfile> — Generate new encryption passphrase in keyfile. A passphrase is generated from random data and is ASCII only.
• -k <keyfile> — Show content of keyfile. If the data is wrapped using a so called Key Encryption Key you also need the -b flag to base64 decode the data that is wrapped using the algorithm described in RFC3394, which gives binary output.
• -p <cachefile> — Populate given cachefile with crypto keys.
• -r <cachefile> — Reset expiry time for entries of given cachefile.
• -s <keyfile> — Set encryption key loaded from keyfile. Load the new key from the keyfile and load it into the drives crypto buffer using a SCSI SPOUT command.
• -v — Show volume encryption status. Request the current volume encryption status by issuing a SCSI SPIN cmd requesting the SPIN_NEXT_BLOCK_ENCR_STATUS_PAGE.
• -w <keyfile> — Wrap/Unwrap the key using RFC3394 aes-(un)wrap using the key in keyfile as a Key Encryption Key. After wrapping the data using this option the output is binary, so you may want to use the -b flag to base64 encode this data.

🌈 SEE ALSO 🌈

• bareos-sd(8),

👑 AUTHOR 👑

This manual page was written by Marco van Wieringen (Bareos).

Okay that’s the whole page, bestie. This was BSCRYPTO(8) from the Backup Archiving REcovery Open Sourced manual, dated 23 February 2013, written by Marco van Wieringen (Bareos). Periodt. 💖