+x

 

uit - 12 February 2023 6:20 AM

For simplicity, thinking of opening 51515 only to specific IP's. Is there anything terribly secret (or secrets that are not encrypted) travelling through port 51515?

Hi,
Port 51515 is the default control channel between site manager server and agent. All command and control information (Agent identities, backup commands, repository credentials) pass through this route. All comms is encrypted - each time an Agent connects to a server, a new AES-256 session key is generated and used to encrypt all comms. The initial crypto negotiation will use a crypto key derived from the Agent passphrase (as set in Settings -> Agent in the server) in order to prevent the possibility of an Agent connecting to a malicious server. 

Actual backup data is written over SMB direct to the repository - if encryption is set for the backup, then unencrypted data is not written to the repo.

It's also worth noting that the connection is always initiated by the Agent rather than the server, so only the server needs to have a firewall rule for incoming connections to port 51515.
As a spoiler for the upcoming 8.1 release, the PE recovery/restore environment will also perform comms over 51515 back to the Site Manager server, so you may want to bear that in mind for any blocking/port restrictions.

Kind Regards,

Alex

Macrium Development

See our reviews on