3 ms·

I have to say, this is an excellent solution and I am seriously contemplating on deploying it for all of our servers. I'm a little unclear on one thing, are al

by Mo3 5y ago

I have to say, this is an excellent solution and I am seriously contemplating on deploying it for all of our servers. I'm a little unclear on one thing, are alternative S3 providers supported?

bccdee 5y ago
Yes! I back up directly into Backblaze B2 using restic.
- Mo3 5y ago
  Excellent. One more question. Assuming someone gains access to a node - will they be able to access the backups or screw with them in any way?
  - lucgommans 5y ago
    Depends which back-end you use and which configuration. (Assuming "node" here means a backup client and not a backup-hosting server.) If you just put stuff on some standard storage (FTP, B2, etc.) without any permissions set up, then no backup client could stop the attacker from using the credentials you've deployed to the backup client to login to your storage and delete your backup files. This is not really specific to restic. Accessing old files from a backup client is a weakness. Though, personally, I don't store things on a system that this system is not supposed to know, so if someone compromises this system and they see data from the past year... that's nearly the same as just seeing the data that is on this system today. Nevertheless, this could be solved by using public keys, so the backup clients has an encryption but no decryption key (of course it's not as trivial as this sounds, e.g. how could it still do deduplication etc.), but restic does not do this.
    - Mo3 5y ago
      Got it. So I guess the best solution to go forward here would be to deploy Minio and then backup the backup directory itself in regular intervals onto different storage not accessible from anywhere.
  - bccdee 5y ago
    There's an object lock feature which prevents objects in a certain bucket from being deleted before X amount of time has elapsed. This might be able to prevent backups from being tampered with. If that doesn't work, there's a restic server which can act as an intermediary and which has an append-only mode which would prevent backups from being tampered with if your computer were compromised.
tome 5y ago
These seem to be the supported backends Local directory sftp server (via SSH) HTTP REST server (protocol, rest-server) Amazon S3 (either from Amazon or using the Minio server) OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage Google Cloud Storage And many other services via the rclone Backend https://github.com/restic/restic#backends= https://github.com/restic/restic#backends=
- Mo3 5y ago
  I saw that, I was specifically wondering about different regular S3 implementations like Linode object storage, Digitalocean spaces, Wasabi, etc
  - wedowhatwedo 5y ago
    Did you try your back end to see if it works? It's not that hard to download the executable and try it.
    - Mo3 5y ago
      Yes, just now. Here's the piece of information I was looking for - rclone supports S3

by Mo3 5y ago

I have to say, this is an excellent solution and I am seriously contemplating on deploying it for all of our servers. I'm a little unclear on one thing, are alternative S3 providers supported?

bccdee 5y ago

Yes! I back up directly into Backblaze B2 using restic.

Mo3 5y ago
Excellent. One more question. Assuming someone gains access to a node - will they be able to access the backups or screw with them in any way?
- lucgommans 5y ago
  Depends which back-end you use and which configuration. (Assuming "node" here means a backup client and not a backup-hosting server.) If you just put stuff on some standard storage (FTP, B2, etc.) without any permissions set up, then no backup client could stop the attacker from using the credentials you've deployed to the backup client to login to your storage and delete your backup files. This is not really specific to restic. Accessing old files from a backup client is a weakness. Though, personally, I don't store things on a system that this system is not supposed to know, so if someone compromises this system and they see data from the past year... that's nearly the same as just seeing the data that is on this system today. Nevertheless, this could be solved by using public keys, so the backup clients has an encryption but no decryption key (of course it's not as trivial as this sounds, e.g. how could it still do deduplication etc.), but restic does not do this.
  - Mo3 5y ago
    Got it. So I guess the best solution to go forward here would be to deploy Minio and then backup the backup directory itself in regular intervals onto different storage not accessible from anywhere.
- bccdee 5y ago
  There's an object lock feature which prevents objects in a certain bucket from being deleted before X amount of time has elapsed. This might be able to prevent backups from being tampered with. If that doesn't work, there's a restic server which can act as an intermediary and which has an append-only mode which would prevent backups from being tampered with if your computer were compromised.

tome 5y ago

These seem to be the supported backends Local directory sftp server (via SSH) HTTP REST server (protocol, rest-server) Amazon S3 (either from Amazon or using the Minio server) OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage Google Cloud Storage And many other services via the rclone Backend https://github.com/restic/restic#backends= https://github.com/restic/restic#backends=

Mo3 5y ago
I saw that, I was specifically wondering about different regular S3 implementations like Linode object storage, Digitalocean spaces, Wasabi, etc
- wedowhatwedo 5y ago
  Did you try your back end to see if it works? It's not that hard to download the executable and try it.
  - Mo3 5y ago
    Yes, just now. Here's the piece of information I was looking for - rclone supports S3