Auto Config backup.

[Gertjan]

Hi,

Google drive == Cloud. So why asking for an option that doesn't make people happy ?

You could use 'any' shell script on pfSense to copy the config file to a location that is accessible to you.
Or use a tool like https://github.com/KoenZomers/pfSenseBackup

[vallum]

@gertjan said in Auto Config backup.:

Hi,

Google drive == Cloud. So why asking for an option that doesn't make people happy ?
Some of the organizations use Google for email/drive.
some have designed their own in-house solution.

You could use 'any' shell script on pfSense to copy the config file to a location that is accessible to you.

yes can be used, but this will be security loophole. config is gonna be in plain text at backup server. hence not complaint

Or use a tool like https://github.com/KoenZomers/pfSenseBackup
this is totally different approach, not quite good for security reasons.

[Grimson]

@vallum said in Auto Config backup.:

You could use 'any' shell script on pfSense to copy the config file to a location that is accessible to you.

yes can be used, but this will be security loophole. config is gonna be in plain text at backup server. hence not complaint

Then encrypt it in your shell script.

[vallum]

@grimson said in Auto Config backup.:

@vallum said in Auto Config backup.:

You could use 'any' shell script on pfSense to copy the config file to a location that is accessible to you.

yes can be used, but this will be security loophole. config is gonna be in plain text at backup server. hence not complaint

Then encrypt it in your shell script.

Yeah can be done but quite messy, it would be nice if liberty to add our own drive or ftpes or sftp in auto config backup.

[Grimson]

@vallum said in Auto Config backup.:

Yeah can be done but quite messy, it would be nice if liberty to add our own drive or ftpes or sftp in auto config backup.

First you talk about security and then you would use ftpes?

[vallum]

@grimson said in Auto Config backup.:

@vallum said in Auto Config backup.:

Yeah can be done but quite messy, it would be nice if liberty to add our own drive or ftpes or sftp in auto config backup.

First you talk about security and then you would use ftpes?

Please read about FTPes .

[Gertjan]

@vallum said in Auto Config backup.:

to add our own drive or ftpes or sftp in auto config backup

pfSEnse has a build in facility - using their disk space "some where".
A facility they can control, thus support.

All other solution : a "one liner" shells script to a remote smb/server/whatever - the script could encrypt on the fly. You control the access of the remote location.
So, there it is : a one line command on a cron tab. Up to you to make something that fits your needs.
Because billions of needs exist, pfSense couldn't implement (and support) them all.

Google has already many possible answers about this question.

[tim.mcmanus]

So your compliance needs are for data to be encrypted while in transit and at rest? What are the additional compliance requirements for data at rest? Sounds a lot like HIPAA or SEC/OCC compliance.

You could simply get an Amazon CentOS server and put it on S3 storage to pass audits. S3 is encrypted at rest, but the data file itself would not be. Depends on your auditor and their mood.

If Netgate had regular audits and could produce/maintain an ISO 27001 document demonstrating compliance, with additional assurances of data encryption at rest, that should also comply with your audit requirements. This is something you will get from any data center provider if they are hosting your stuff.

But without knowing what your data at rest compliance requirements are, getting you an exact solution to your compliance needs may be elusive.

[vallum]

@gertjan said in Auto Config backup.:

@vallum said in Auto Config backup.:

to add our own drive or ftpes or sftp in auto config backup

pfSEnse has a build in facility - using their disk space "some where".
A facility they can control, thus support.

All other solution : a "one liner" shells script to a remote smb/server/whatever - the script could encrypt on the fly. You control the access of the remote location.
So, there it is : a one line command on a cron tab. Up to you to make something that fits your needs.
Because billions of needs exist, pfSense couldn't implement (and support) them all.

Google has already many possible answers about this question.

Firewall already has backup service as core component :
https://www.netgate.com/docs/pfsense/backup/autoconfigbackup.html , hardcoded netgate cloud storage . point which I wanna make is users should have the liberty to select storage of their choice.

[vallum]

@tim-mcmanus said in Auto Config backup.:

So your compliance needs are for data to be encrypted while in transit and at rest? What are the additional compliance requirements for data at rest? Sounds a lot like HIPAA or SEC/OCC compliance.

yes at rest and as well as in transit. Also methodology used to achieve backup.

You could simply get an Amazon CentOS server and put it on S3 storage to pass audits. S3 is encrypted at rest, but the data file itself would not be. Depends on your auditor and their mood.

If Netgate had regular audits and could produce/maintain an ISO 27001 document demonstrating compliance, with additional assurances of data encryption at rest, that should also comply with your audit requirements. This is something you will get from any data center provider if they are hosting your stuff.

But without knowing what your data at rest compliance requirements are, getting you an exact solution to your compliance needs may be elusive.

well I already have external server in place which used git-crypt to store config and generates email for every change done in firewall with source ip and username.
it took around 2 months to design this solution using dozens of open source modules. only problem is that keyless ssh is used which is not safe when firewall is in picture.