Tape backup drive encryption failure

Details

With LTO tape backups for Proxmox Backup Server prior to the versions listed below, the separate hardware encryption key was unloaded from the tape drive too early, before the transfer of backup data to the tape device was started. This means that data meant to be encrypted on tape actually was not.

If a backup snapshot was already encrypted in the backup server datastore before backing up to tape, the backup data still is encrypted on the tape, but metadata such as the list of snapshots, which chunk belongs to which snapshot etc. is not.

Affected tapes can be restored normally, but there is currently no way to re-encrypt the data on the tape directly. The data has to be restored into a datastore and backed up again with the fixed versions of proxmox-backup-server.

Tape backups on a media pool with a configured encryption key are properly encrypted once a new media set is started with the fixed versions below.

Behoben in

• proxmox-backup-server 3.1.4-1 (Proxmox Backup Server 3.x)

• proxmox-backup-server 2.4.5-1 (Proxmox Backup Server 2.x)