5 ms·

Other replies have backed into this, but the best solution is to 1. Use a COW (copy-on-write) filesystem like btrfs or ZFS 2. Set up snapshots to be taken per

Other replies have backed into this, but the best solution is to 1. Use a COW (copy-on-write) filesystem like btrfs or ZFS 2. Set up snapshots to be taken periodically (hourly/daily) and sent to a different host or volume. 3. Monitor disk usage: if you get hit by a cryptolocker, your disk usage will approximately double as it rewrites all your files. 4. Manually backup snapshots or the full volume to offline storage every N days/weeks/months. In case you missed it, I wrote this up a while back: https://photostructure.com/faq/how-do-i-safely-store-files/ https://photostructure.com/faq/how-do-i-safely-store-files/ TL;DR: Lots of copies keeps stuff safe!

cunthorpe 5y ago
5. Don’t use (only) direct disk access to backups I think all of that is lost if the cryptolocker just formats any volumes named Backup. The copy-on-write can’t just be enforced by the filesystem. If this computer can permanently delete content on the backup system, then so can the locker.
xmodem 5y ago
Another important step - make the offiste backup 'pull' based - so the credentials to access the data already there do not exist on the system being backed up.
- BLKNSLVR 5y ago
  Yes! My homelab, admittedly low complexity, uses a NAS device that powers on at a scheduled time, mounts the shares it needs to, runs the 'pull' backup, unmounts, and powers itself off. The intention being that, in the event of intrusion, it's presence and accessibility are limited to the window of time in which it's performing the backup. Additionally to that, a rotating set of removable HDDs as backups of backups that also get spread off-site amongst family members houses. I really should go into offering backup solutions to local small business...
bruce343434 5y ago
What's the point of COW? There are 0 tools that restore the "orignals" of the copies on write.
- tjoff 5y ago
  In this context COW typically comes with cheap snapshots. And restoring from snapshots is trivial.
hda111 5y ago
2. Always pull the snapshots from another host with tools like syncoid. This host must be inaccessible from network so it can’t be infected.
unilynx 5y ago
> 2. Set up snapshots to be taken periodically (hourly/daily) and sent to a different host or volume. Does btrfs or ZFS have a way to pull snapshots in a way that they are encrypted on the client side ? Ideally you could hire a third party to pull these backups from you, have them warn you when the process fails or doubles in size (the data is being encrypted) and still be able to prove that there's no way they can access the data. And then the private master key(s) go into a safe.

cunthorpe 5y ago

5. Don’t use (only) direct disk access to backups I think all of that is lost if the cryptolocker just formats any volumes named Backup. The copy-on-write can’t just be enforced by the filesystem. If this computer can permanently delete content on the backup system, then so can the locker.

xmodem 5y ago

Another important step - make the offiste backup 'pull' based - so the credentials to access the data already there do not exist on the system being backed up.

BLKNSLVR 5y ago
Yes! My homelab, admittedly low complexity, uses a NAS device that powers on at a scheduled time, mounts the shares it needs to, runs the 'pull' backup, unmounts, and powers itself off. The intention being that, in the event of intrusion, it's presence and accessibility are limited to the window of time in which it's performing the backup. Additionally to that, a rotating set of removable HDDs as backups of backups that also get spread off-site amongst family members houses. I really should go into offering backup solutions to local small business...

bruce343434 5y ago

What's the point of COW? There are 0 tools that restore the "orignals" of the copies on write.

tjoff 5y ago
In this context COW typically comes with cheap snapshots. And restoring from snapshots is trivial.

hda111 5y ago

2. Always pull the snapshots from another host with tools like syncoid. This host must be inaccessible from network so it can’t be infected.

unilynx 5y ago

> 2. Set up snapshots to be taken periodically (hourly/daily) and sent to a different host or volume. Does btrfs or ZFS have a way to pull snapshots in a way that they are encrypted on the client side ? Ideally you could hire a third party to pull these backups from you, have them warn you when the process fails or doubles in size (the data is being encrypted) and still be able to prove that there's no way they can access the data. And then the private master key(s) go into a safe.