Immutable Backups reddit / selfhosted ---------------------------------------------------------------------- CatoDomine · 2023-12-04 19:09 We all know how important backups are. Local backups, off-site backups etc. I generally use borg for both. Immutable backups are something I've been mostly ignoring, but I think the time has come to have some kind of backup that cannot be easily tampered with by an infiltrator, ransomware or what have you. How have some of you in the selfhosted community handled this? ---------------------------------------------------------------------- watchdog_timer · 2023-12-04 19:16 I'm in the process of moving over my Debian sustem to btrfs so I can easily make snapshots and create immutable backups. ---------------------------------------------------------------------- chkno · 2023-12-04 22:16 I use [`dar`](http://dar.linux.free.fr/doc/mini-howto/dar- differential-backup-mini-howto.en.html) for this. It generates archive files that I copy to remote, write-only, immutable storage. It supports differential / incremental backup without needing to read back the remote archive files: At the end of each run, it generates a small-ish (~15 MiB) metadata file with the pathnames, sizes, and modification-times of all the files in the archive. Then, during the next run, it reads this to detect unchanged files. ---------------------------------------------------------------------- lilolalu · 2023-12-04 22:19 I don't, but take a look at tahoe-lafs if you want to do this backup in a cloud. https://tahoe-lafs.org/trac/tahoe-lafs ---------------------------------------------------------------------- Redoo64 · 2023-12-05 00:13 You can simply use Borg's built-in `append-only` option. https://borgbackup.readthedocs.io/en/stable/faq.html#how-can-i- protect-against-a-hacked-backup-client https://borgbackup.readthedocs.io/en/stable/usage/notes.html#append- only-mode-forbid-compaction It is also supported by borgbase,com and works great. ---------------------------------------------------------------------- InvaderToast348 · 2023-12-05 09:37 If the storage is write-only, how do you get your data off it if you need to restore? ---------------------------------------------------------------------- chkno · 2023-12-05 17:56 A separate account has the read access. The machines sending their backup archives have no read access. ---------------------------------------------------------------------- InvaderToast348 · 2023-12-05 18:11 Ah, smart! ---------------------------------------------------------------------- -SPOF · 2023-12-12 02:08 I'm currently working on several projects involving a Linux Hardened repository, which enables immutable storage. However, they require Veeam integration. You can use a ready-made solution like [this](https://www.starwindsoftware.com/blog/starwind-san-nas-as- hardened-repository-for-veeam-br) or set it up from scratch on any Linux disto. For offsite backups, popular cloud services like AWS, Backblaze B2, or Wasabi are commonly used as they all offer immutability.