Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adds changes to docs caused by exclusion of SSH from the restore process. #190

Merged
merged 2 commits into from
Apr 6, 2021
Merged

Adds changes to docs caused by exclusion of SSH from the restore process. #190

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9e3ea2f
updated restore procedure to remove SSH-related manual config update
zenmonkeykstop Apr 4, 2021
413b265
Added note about restrictions when restoring from SSH-over-LAN backups
zenmonkeykstop Apr 5, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 10 additions & 15 deletions docs/backup_and_restore.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,6 +167,12 @@ Moving a SecureDrop instance to new hardware involves:
All new SecureDrop instances must use v3 onion services only, so the final
configuration will only include v3 onion services regardless of the backup state.

.. note:: If you need to restore from a backup from an instance configured to
use SSH-over-LAN onto an SSH-over-Tor instance, you must either first update
the target instance to use SSH-over-LAN or perform a data-only backup.
See :ref:`Data-only Restores <additional_restore_info>` for more information.


The restore process differs based on the onion services that were configured on
the old instance and preserved in the backup:

Expand Down Expand Up @@ -314,25 +320,14 @@ Migrating Using a V2+V3 or V3-Only Backup
./securedrop-admin restore sd-backup-old.tar.gz

The restore task will proceed for some time, removing v2 services if a v2+v3
backup was used, and then will fail with the message:

.. code-block:: none
backup was used.

ssh_exchange_identification: Connection closed by remote host

during the ``Wait for Tor to reload`` task. This is expected; the
*Application Server*'s SSH onion service address was updated to the old
instance's address during the restore process, leaving it temporarily
unreachable.

#. Copy the old instance's v3 onion service details into place on the
*Admin Workstation* and repair SSH access using the Terminal commands:
#. Synchronize the server and *Admin Workstation's* web interface config and
authentication keys using the Terminal commands:

.. code:: sh

cd ~/Persistent/securedrop
cp $SD_OLD/app-{journalist,ssh}.auth_private $SD_NEW/
cp $SD_OLD/app-sourcev3-ths $SD_NEW/
./securedrop-admin install
./securedrop-admin tailsconfig

#. :doc:`Test the new instance <test_the_installation>` to verify that the
Expand Down