I’m planning to setup backup on my nas with the 3-2-1 backup rule.

For the backup disks I want full disk encryption, but I also want to be really sure that I don’t lose the encryption keys if I lose my phone and computer where I have my password manager.

What is a good practice to store the encryption key(s)?

One thought I had was to have an unencrypted partition on the backup disks that stores an encrypted keepass database with the key.

Any tips or experiences are welcome.

PS. I want to avoid cloud-based options.

  • ki9@lemmy.gf4.pwEnglish
    3·
    13 hours ago

    You can dettach your headers with --header.

    I’ve started putting the header and key on my boot partition on a USB key. Without the usb, the hard drives appear to be filled only with random data (plausible deniability). After booting, the USB can be removed to prepare for a panic shutdown.

    • irmadlad@lemmy.worldEnglish
      1·
      10 hours ago

      You can dettach your headers with --header.

      I did not know this. That would seem, abiding by your system, to be more secure. I will have to investigate.

      Thanks for sharing.