Secure Credential Management with SyncBackPro Secrets Manager

Author: Swapna Naraharisetty, 2BrightSparks Pte. Ltd.

SyncBackPro’s Secrets Manager facilitates the secure retrieval and management of sensitive data such as usernames, passwords, and private keys from leading secrets managers and password managers. By integrating with these services, SyncBackPro ensures that your credentials are accessed securely and used directly within your backup operations, without the need to store them in SyncBackPro's profile settings. This centralized approach provides enhanced security and streamlined management of your confidential information.

These are supported:

• AWS Secrets Manager
• Azure Key Vault
• Google Cloud Secret Manager
• HashiCorp Vault
• Infisical
• Windows Credential Manager
• 1Password, through a 1Password Connect server that you run yourself (see Using 1Password with SyncBackPro)
• Dashlane, through the Dashlane CLI (see Using Dashlane with SyncBackPro)
• Bitwarden, through the Bitwarden CLI (see Using Bitwarden with SyncBackPro)

Support for 1Password, Dashlane and Bitwarden was added in SyncBackPro V12.1.21, so you need that version or newer. Each needs some setting up on the password manager's side first, which the linked articles walk through.

Secrets Manager is only supported in SyncBackPro. It is not available in SyncBackSE and SyncBackFree.

Important Points to Note

• SyncBackPro only requires read access to your secrets manager to list and retrieve secret values. It does not create, delete, or modify any secrets stored in the secrets manager.
• The secret's value is never displayed to the end user or stored locally. Only the connection details for the secrets managers and the specific secrets to be used are stored in the program settings.
• Secrets are retrieved from the secrets manager when a profile runs, and nothing is kept once it finishes. With Dashlane and Bitwarden, an encrypted copy of the vault is kept in a temporary folder while the profile runs, so that all the secrets it uses can share one sign-in, and it is deleted when the profile finishes.
• A secret stored in a secrets manager must be in plain text or JSON format. With a password manager (1Password, Dashlane or Bitwarden) you pick an item, such as a login, and which part of it to use, such as its password.
• Before connecting to your secrets manager, make sure it contains at least one secret.

Using Secrets Manager

In this example, we will connect to Windows Credentials Manager and define a secret for use in SyncBackPro. This assumes that you already have credentials stored in the Generic Credentials section of the Windows Credentials Manager.

1. Run SyncBackPro, click on the burger menu and select Secrets Manager.
2. On the Connections page, click the Create button and choose Windows from the dropdown menu.
3. Enter the name you would like to give to the connection (e.g. Windows connection), and the connection to your Secrets Manager will be established. Please note that the connection details you need to enter will vary based on the type of secrets manager you select. For more information, refer to the Help file under the Secrets Manager page.
4. Navigate to the Secrets tab, click the Create button, and select the type of secret you wish to use. The three types available are Username, Password, and Private Key. In this example, we will choose Password.
5. You are then asked for the following, one dialog at a time:
   • Name: This is the name of the secret stored in the secrets manager.
   • Description: If a description exists for the secret in the secrets manager, SyncBack will retrieve it. Otherwise, you can enter your own description of the secret.
   • Key: If the secret is stored in JSON format or as key/value pairs, you must specify which key to retrieve the secret from. For example, a secret might contain both a username and a password, so you need to indicate which key holds the relevant value. If the secret has only one key, you are not asked.
   
6. Click the OK button, and the secret is defined.
7. Next, we will use the secret as an encryption password in a backup profile to store the files as encrypted on the destination. Modify the profile, go to Compression > Password, click the dropdown menu, and select Use a secret.
8. Click the name of the secret and click the OK button.
9. Save the settings and run the profile. SyncBackPro will use the secret configured on the Compression page to encrypt the files.

Conclusion

The Secrets Manager streamlines the management of sensitive credentials by offering a centralized, secure solution. By leveraging a Secrets Manager, you can significantly reduce the risk of data breaches while ensuring compliance with your company’s security protocols.