Uploaded image for project: 'Percona XtraBackup'
  1. Percona XtraBackup
  2. PXB-2142

Transition key was written to backup / stream

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Done
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: 2.4.11, 8.0.4
    • Fix Version/s: 2.4.20, 8.0.11
    • Component/s: None
    • Labels:

      Description

      Based on the documentation, to save a backup to some cloud provider, we should execute the following command:

      xtrabackup --backup --stream=xbstream --target-dir=/tmp | xbcloud \
      put [options] <name>
      

      from https://www.percona.com/doc/percona-xtrabackup/LATEST/xbcloud/xbcloud.html

      Let's combine this with a custom transition key:

      xtrabackup --backup --stream=xbstream --transition-key=foobar > xbstream.output
      

      After taking this backup, look for the transition key in it:

      cat xbstream.output | grep -a foobar
      

      And it's there in clear text, written as part of the tool_command in xtrabackup_info. Conveniently at the end of the file, so executing tail instead of grep is also enough.

      Meaning that anybody who uses this approach to save an encrypted database on the cloud basically exposes his entire data (and tablespace keys, which will stay the same until he rebuilds all encrypted tables)

        Smart Checklist

          Attachments

            Issue Links

              Activity

                People

                Assignee:
                rahul.malik Rahul Malik
                Reporter:
                zsolt.parragi Zsolt Parragi
                Votes:
                0 Vote for this issue
                Watchers:
                7 Start watching this issue

                  Dates

                  Created:
                  Updated:
                  Resolved:

                    Time Tracking

                    Estimated:
                    Original Estimate - 1 day, 5 hours Original Estimate - 1 day, 5 hours
                    1d 5h
                    Remaining:
                    Time Spent - 7 hours Remaining Estimate - 1 day, 5 hours
                    1d 5h
                    Logged:
                    Time Spent - 7 hours Remaining Estimate - 1 day, 5 hours
                    7h