--- title: Charmhub | Deploy Bootstack Charmers Duplicity using Charmhub - The Open Operator Collection description: Deploy the latest version of Bootstack Charmers Duplicity on any cloud. url: https://charmhub.io/bootstack-charmers-duplicity/docs/r-cryptography --- # Bootstack Charmers Duplicity [Canonical BootStack Charmers](https://charmhub.io/publisher/bootstack-charmers "View all packages from Canonical BootStack Charmers") * [Canonical BootStack Charmers](https://charmhub.io/publisher/bootstack-charmers "View all packages from Canonical BootStack Charmers") Platform: 22.04 20.04 18.04 16.04 stable 23.10 ``` juju deploy bootstack-charmers-duplicity ``` [Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications) --- Share your thoughts on this charm with the community on discourse. [Join the discussion](https://discourse.charmhub.io/) # Cryptography ## [Data in transit](https://charmhub.io/bootstack-charmers-duplicity/docs/r-cryptography#p-34061-data-in-transit) The cryptography used for file transfers depends on the **backend** charm option. For all backend options it’s necessary to set the **remote\_backup\_url**. ### [SSH - Charm side](https://charmhub.io/bootstack-charmers-duplicity/docs/r-cryptography#p-34061-ssh-charm-side) The backends for backups that use SSH are: **rsync, scp, and sftp**. For those options the user needs to pass the following charm configuration: * **private\_ssh\_key**: This is the base64-encoded private ssh key that will be placed in the duplicity unit disk at **/root/.ssh/duplicity\_id\_rsa** with read and write permissions for the owner of the file, in this case the root user. This key is used to authenticate the duplicity application against the remote backup host. Note that the public key of the client should be stored in the remote backup host in order to accept the connection. * **known\_host\_key**: This option is used to store the fingerprint (a hash of the remote host public key) that will be placed in the duplicity unit disk at **/root/.ssh/known\_hosts**. The known\_hosts file essentially acts as a trust store for remote server identities. Storing the server’s public key fingerprint ensures that you’re connecting to the correct server in future sessions, avoiding Man-in-the-Middle attacks. * **remote\_password**: This is an alternative to the public and private keys used for authentication. In summary, it’s possible to connect via SSH in two ways: * Key-based authentication using private and public keys. * Password-based authentication using passwords. ### [SSH - Payload side](https://charmhub.io/bootstack-charmers-duplicity/docs/r-cryptography#p-34061-ssh-payload-side) Duplicity uses the [paramiko](https://github.com/paramiko/paramiko) library, which relies on the SSHv2 protocol and uses the [cryptography](https://cryptography.io/en/latest/) Python package for crypto functionality. Paramiko provides an easy-to-use interface for handling SSH and SFTP communications, enabling secure remote operations over SSH without the need for command-line tools. ### [HTTPS - Charm side](https://charmhub.io/bootstack-charmers-duplicity/docs/r-cryptography#p-34061-https-charm-side) Both S3 and Azure backends use an HTTPS-based API for file transferring. For AWS S3 buckets the user needs to provide the **aws\_access\_key\_id** and **aws\_secret\_access\_key** charm options. These options will be used as environment variables with the names AWS\_ACCESS\_KEY\_ID and AWS\_SECRET\_ACCESS\_KEY, respectively. Note that it is necessary to have upload privileges to S3 buckets to be able to store the backups. For Azure, it’s necessary to use the **azure\_connection\_string** charm option that will be used as an environmental variable named AZURE\_CONNECTION\_STRING. For more information about the connections string see the [documentation](https://learn.microsoft.com/en-us/azure/storage/common/storage-configure-connection-string#configure-a-connection-string-for-an-azure-storage-account). ### [HTTPS - Payload side](https://charmhub.io/bootstack-charmers-duplicity/docs/r-cryptography#p-34061-https-payload-side) Duplicity uses the [boto3](https://pypi.org/project/boto3/) library for handling S3 buckets and [azure-storage-blob](https://pypi.org/project/azure-storage-blob/) for the Azure backend. ### [No cryptography](https://charmhub.io/bootstack-charmers-duplicity/docs/r-cryptography#p-34061-no-cryptography) If **ftp** is used as a backend, there is no cryptography technology for data transferring. ## [Data at rest](https://charmhub.io/bootstack-charmers-duplicity/docs/r-cryptography#p-34061-data-at-rest) Backups can be encrypted using GPG asymmetrically using keys or symmetrically using password. ### [GPG keys](https://charmhub.io/bootstack-charmers-duplicity/docs/r-cryptography#p-34061-gpg-keys) GPG uses a public key to encrypt data asymmetrically, so that only the owner of the private key may be able to decrypt it. To use this technology, use the **gpg\_public\_key** charm option to set the public key that will be used to encrypt the files. ### [Password](https://charmhub.io/bootstack-charmers-duplicity/docs/r-cryptography#p-34061-password) As an alternative, users can set an encryption passphrase via the **encryption\_passphrase** charm option. Duplicity will encrypt symmetrically by invoking `gpg` with the `--symmetric` option. At the moment this yields an **AES256**-encrypted file. ### [No cryptography](https://charmhub.io/bootstack-charmers-duplicity/docs/r-cryptography#p-34061-no-cryptography) Users can disable backup encryption by setting the **disable\_encryption** charm configuration option to True. ---