4 ms·

Is that a big deal? You should probably be doing this with zfs immutable snapshots anyway. Or equivalent feature for your filesystem.

topato 1y ago
I'm also completely confused why this was at the top of my hacki, seems completely innocuous
- ajb 1y ago
  Ideally a backup system should be implementable in such a way that no credential on the machines being backed up, enable the deletion or modification of existing backups. That's so that if your machines are hacked a) the backups can't be deleted or encrypted in a ransom attack and b) If you can figure out when the first compromise occurred, you know that before that date the backup data is not compromised. I guess some people might have been relying on this feature of borgbackup to implement that requirement
philsnow 1y ago
The purpose of the append-only feature of borgbackup is to prevent an attacker from being able to overwrite your existing backups if they compromise the device being backed up. Are you talking about using ZFS snapshots on the remote backup target? Trying to solve the same problem with local snapshots wouldn't work because the attack presumes that the device that's sending the backups is compromised.
- LeoPanthera 1y ago
  > Are you talking about using ZFS snapshots on the remote backup target? Yes.
homebrewer 1y ago
There's not much sense in using these advanced backup tools if you're already on ZFS, even if it's just on the backup server, I would stick with something simpler. Their whole point is in reliable checksums, incremental backups, deduplication, snapshotting on top of a 'simple' classical filesystem. Sounds familiar to any ZFS user?
- nijave 1y ago
  Dedupe is efficient in Borg. The target needs almost no RAM
- globular-toast 1y ago
  Are there any good options for an off-site zfs backup server besides a colo? Would be interested to know what others have set up as I'm not really happy with how I do it. I have zfs on my NAS running locally. I backup to that from my PC via rsync triggered by anacron daily. From my NAS I use rclone to send encrypted backups to Backblaze. I'd be happier with something more frequent from PC to NAS. Syncthing maybe? Then just do zfs sync to some off site zfs server.
  - gaadd33 1y ago
    I think Rsync.net supports zfs send/receive
  - aeadio 1y ago
    Aside from rsync.net which was mentioned in a sibling comment, there’s also https://zfs.rent https://zfs.rent, or any VPS with Linux or FreeBSD installed.
    - globular-toast 1y ago
      zfs.rent is in the wrong location and I can't see anything about zfs send/receive support on rsync.net. What kind of VPS product has multiple redundant disks attached? Aren't they usually provided with virtual storage?
      - Tharre 1y ago
        It's documented here: https://www.rsync.net/products/zfsintro.html https://www.rsync.net/products/zfsintro.html Do note the 5 TiB minimum order for it though, it's not something that's enabled on other accounts.
- PunchyHamster 1y ago

topato 1y ago

I'm also completely confused why this was at the top of my hacki, seems completely innocuous

ajb 1y ago
Ideally a backup system should be implementable in such a way that no credential on the machines being backed up, enable the deletion or modification of existing backups. That's so that if your machines are hacked a) the backups can't be deleted or encrypted in a ransom attack and b) If you can figure out when the first compromise occurred, you know that before that date the backup data is not compromised. I guess some people might have been relying on this feature of borgbackup to implement that requirement

philsnow 1y ago

The purpose of the append-only feature of borgbackup is to prevent an attacker from being able to overwrite your existing backups if they compromise the device being backed up. Are you talking about using ZFS snapshots on the remote backup target? Trying to solve the same problem with local snapshots wouldn't work because the attack presumes that the device that's sending the backups is compromised.

LeoPanthera 1y ago
> Are you talking about using ZFS snapshots on the remote backup target? Yes.

homebrewer 1y ago

There's not much sense in using these advanced backup tools if you're already on ZFS, even if it's just on the backup server, I would stick with something simpler. Their whole point is in reliable checksums, incremental backups, deduplication, snapshotting on top of a 'simple' classical filesystem. Sounds familiar to any ZFS user?

nijave 1y ago
Dedupe is efficient in Borg. The target needs almost no RAM
globular-toast 1y ago
Are there any good options for an off-site zfs backup server besides a colo? Would be interested to know what others have set up as I'm not really happy with how I do it. I have zfs on my NAS running locally. I backup to that from my PC via rsync triggered by anacron daily. From my NAS I use rclone to send encrypted backups to Backblaze. I'd be happier with something more frequent from PC to NAS. Syncthing maybe? Then just do zfs sync to some off site zfs server.
- gaadd33 1y ago
  I think Rsync.net supports zfs send/receive
- aeadio 1y ago
  Aside from rsync.net which was mentioned in a sibling comment, there’s also https://zfs.rent https://zfs.rent, or any VPS with Linux or FreeBSD installed.
  - globular-toast 1y ago
    zfs.rent is in the wrong location and I can't see anything about zfs send/receive support on rsync.net. What kind of VPS product has multiple redundant disks attached? Aren't they usually provided with virtual storage?
    - Tharre 1y ago
      It's documented here: https://www.rsync.net/products/zfsintro.html https://www.rsync.net/products/zfsintro.html Do note the 5 TiB minimum order for it though, it's not something that's enabled on other accounts.
PunchyHamster 1y ago