User Configuration Within the Magnus Box Web Portal
Each user in the Web Portal is built from two main parts, Protected Items and Storage Vaults, plus the devices registered to it. This page explains how they fit together so you can plan a client's setup.
Protected Items and Storage Vaults
- A Protected Item describes what to back up: a set of data on one device.
- A Storage Vault is where the backed-up data is stored. That's usually Magnus Box cloud storage, but it can also be a local disk, a network path or another destination.
All data in a Storage Vault is compressed, encrypted and deduplicated. Deduplication happens within each Storage Vault. Data is never deduplicated across separate vaults. That's the main sizing decision: a shared vault gives better deduplication, while separate vaults use less RAM per device and keep devices apart.
Devices
Multiple devices can log in to the same user account. Each device has its own Protected Items but shares the user's Storage Vaults, which is what lets data be deduplicated across devices. Devices on the same user can also restore (and delete) each other's backed-up data, so only put devices from one client organization on the same user, never devices from different clients. See Device registration (Logging into the Magnus Box Software).
New accounts
A new user has no Protected Items until you add them. With the default settings, a Storage Vault is created automatically when the first device registers, named after the device (for example "Cloud Storage Vault (CONTOSO-PC01)"). You can also add Storage Vaults yourself. See Creating Storage Vaults. For settings you want on every user, use a policy. See Policy Settings.
To keep a client's users together in the Web Portal, put them in a User Group. See Group client accounts with User Groups.
Encryption and passwords
All user data is encrypted before storage using AES-256 in CTR mode, authenticated with Poly1305 in AEAD mode, with high-entropy random keys. The backup app creates and manages the keys automatically. The data encryption keys are themselves encrypted with the user's password and stored on the server. This means:
- Magnus Box cannot decrypt client data without the account password.
- If a client device is lost, the account password is all that's needed to log in from a new device and restore.
So the user's password is what protects everything. Use a strong, unique password for every user. A weak password (123456, letmein) undoes all of the above. For the full technical details, see Encryption and key management.
Before/after commands
You can register commands to run before or after backup jobs, attached at three levels:
- Protected Item: for example, dump a database before the backup
- Storage Vault: for example, sign in to a network location
- Schedule: for example, shut the computer down afterwards
Execution order during a job: Schedule Before → Protected Item Before → Storage Vault Before → Backup → Storage Vault After → Protected Item After → Schedule After.
Commands are passed to cmd.exe (Windows) or /bin/sh (macOS/Linux), so shell built-ins work.
Need help? Email support@magnusbox.com.