Backup and restore

Little Snitch has two storage formats for the rule set and settings:

An encrypted proprietary format which is built to be updated efficiently. It is stored in /Library/Application Support/Objective Development/Little Snitch/configuration6.xpl.
An export format in JSON syntax which is designed to be human-readable and diffable with file extension .lsbackup.

Little Snitch can import both formats as well as formats from older versions of Little Snitch via Little Snitch > File > Restore from Backup… or via the command line tool

Backup using Time Machine and similar

You probably already make regular backups of your Mac and chances are that you include /Library/Application Support in these backups. If you backup this folder, half of the work is already done. But that’s only half of the work! This directory contains the proprietary encrypted configuration.

Since the file is encrypted you also need the encryption key to make use of it. The encryption key is stored in the System keychain of the Keychain Access app under the name “Little Snitch Encryption Key”. Make sure you have a copy of this key in case you need to restore, or do a test restore to check whether your System keychain is included and restored correctly (to a different computer!).

Backing up this entire folder has the advantage that it includes not only the configuration but the (also encrypted) traffic history as well.

Creating a backup file

Backups in the second format, as an .lsbackup file, are created via the main menu item File > Create Backup… or via the command line tool. This type of backup contains all rules and all settings relevant for the filter. It does not include the traffic history, though.

Backups in this format are not encrypted. Keep in mind that a potential attacker may gain knowledge of your rule set and the rule set of other users on the computer at the time of backup.

The advantage of this backup format is that it can be read and processed with standard libraries and it can be compared for changes with other backups using a diff tool.

Restoring from a backup

Choose File > Restore from Backup… from the main menu of Little Snitch. The following dialog presents a list of potential backups found via Spotlight, but you can also choose an explicit file. Backup files are available from:

Automatic daily backups to /Library/Application Support/Objective Development/Little Snitch. The backup files contain the date and time of their creation in the name.
Automatic backups of the old configuration when a backup is restored. You can use them to revert a restore. They have importBackup in the file name.
.lsbackup files found via Spotlight.
Configurations in proprietary format which have been discarded because they caused a crash or could not be read. They have crashOnLoad in their name.
Backups and configurations in proprietary format from older versions.

Choose a file to restore, continue and confirm the restore in the next step.

Backups contain rules and settings for all users. Users are identified by their numeric Unix User identifier, not by name. If you restore on a different machine, there may be more or less accounts than on the machine where the backup was created and the user identifiers may be assigned in a different order.

If user identifiers differ from backup to restore, you need to restore from the command line, passing a user mapping as a command argument.