4 ms·

I think you missed his point. He meant its safer to give the live server no access because if it gets hacked/virus then it can not impact the backup server.

• cperciva 15y ago
  I think you missed my point. I was suggesting that the live server should access the backup server via an append-only interface, i.e., one which doesn't allow it to delete backups or modify them.
  • snowwrestler 15y ago
    Now the security of your backups is completely dependent on the construction of the append-only interface. Are you 100% certain it can't be compromised or permission-escalated?
    • cperciva 15y ago
      It's much easier to build an append-only interface than a read-only-and-only-read-some-files-not-others interface.