> With ZFS snapshots the older snapshots would still be present on the target server, in their unencrypted form. Only and only if you apply best practicies men

> With ZFS snapshots the older snapshots would still be present on the target server, in their unencrypted form. Only and only if you apply best practicies mentionned above in the second point of your post. Anyway I'd rather protect my backup as much as I can and not allow the source machine to have any direct access to an account on the backup server because of possible security. Security is hard sometimes and you never know when some bugs might increase the possibilities. I like my backup servers to not have any open port. The caveat is that it is only possible if your primary backup server is locally and physically accessible. If you are travelling you might want to be able to access it without being physically present. An option might be to just have ssh disabled when you are at home and you enable the service when you know you won't be at home for a long enough period to make it a problem if you need to restore data.