Off-site backup to a NAS; potential security concerns? reddit / selfhosted ---------------------------------------------------------------------- nightmareFluffy · 2023-12-22 20:22 I have a work server for my business (I'm a business owner) and a home server. Each one has a NAS for backups. I was thinking of using the work NAS to back up home stuff, and the home NAS to back up work stuff. Here's the issue. What if a virus gets into either of the systems, traverses the network, and puts all my files into a ransom situation? Since I'm running a business, it's likely I'll pay to get the data back. Even though the NAS's are offsite from each other, I have a Tailscale VPN connection so I can access home files from work and work files from home. It's mostly for using SMB file server. I can't break this connection because sometimes I work from home, and have to manage employees from home. I need full access. I'm worried if a virus crawls its way through the VPN. I'm consulting with an IT person about this, but wanted to get some opinions. ---------------------------------------------------------------------- flicman · 2023-12-22 20:48 I'm sort of thinking about this on my own, and my solution (that I have yet to implement) is to do weekly snapshot backups with monthly fulls, kept a year. I'm only going to connect my backup thing to my network (I, too, have a home and work server) via VPN and not expose anything else. The way I see it is that I'll probably notice any virus/problem within the week, but if I don't, I'll only lose a month. It's a lot, but not EVERYTHING. Also, I work in entertainment, so people WANT but do not NEED the data we have. It's not healthcare or anything. ---------------------------------------------------------------------- nightmareFluffy · 2023-12-22 20:52 How do you connect something only over VPN? Presumably, it'll have to also be connected to your router. Though I guess in that case, the only thing it will expose is the login screen. If you use a different password than the usual one, it should be secure enough. If you connect it via VPN, what protocol are you going to use? I was thinking of not using a VPN on it at all and simply use FTP with a different-than-usual password. It's a lot more secure than SMB shares. If a hacker was truly motivated, they can crack an FTP, but it's significantly harder to do. It seems like a decent solution, because most of these ransomware attacks are done by bots. I doubt a hacker will take the time to hack into your files unless you're running a Fortune 500 company or something. ---------------------------------------------------------------------- flicman · 2023-12-22 20:58 Well, not having done it yet, I can only give you generalization. Wireguard will create a tunnel between client and server, and, in theory, that should be enough. My backup system won't have any access to the internet outside that VPN, so if the VPN fails somehow, it's down till I physically go there and fix it, which I actually like for my use case. I'll pick a backup software that does what I need it to do, but haven't chosen one yet. I have tabs open reading white papers and comparing, but something like ur-backup, duplicati or whatever might work? Time will tell. ---------------------------------------------------------------------- Other-Technician-718 · 2023-12-22 21:00 Set your home nas up in a way that it pulls the files from your work nas and don't access that home nas from home - prevent that with firewall rules or other means. I'm in a similar situation: I have set up Proxmox on my server, Proxmox Backup Server as a VM and backing up to a NAS. Server and Backup VM and NAS live on a management vlan separated by opnsense to my other vlans (clients, mobile devices, internal servers, external servers like nextcloud and mail, printers). At home I have a VM on my Synology with Proxmox Backup server running. That backup server at home pulls backups daily from the backup server in my office. Even if e.g. my cloud VM gets infected there is no way it can spread to my backup VM unless it can traverse vlans, escape the VM or bypass the firewall (there are very strict rules to access the management vlan). I have no files at home I need in my office - if I need work stuff at home I have my nextcloud server. I guess you could build something similar with your nas software: e.g. mount your office nas as nfs share on your home nas to back it up. prevent access to your home nas from all devices at home. reminder to myself: disable direct access to offsite backup from my office - at the next maintenance. ---------------------------------------------------------------------- raph-dev · 2023-12-22 21:10 Easy: Borg/restic/kopia in append only mode. ---------------------------------------------------------------------- nightmareFluffy · 2023-12-22 21:14 Thanks for your ruminations. About the backup software, I got you, bruh. Duplicati all the way. I've tried other software, and this is the best. Others might have more features, which I don't need. Others might not have more features, cost more than $0, and be less reliable. Duplicati allows for custom retention strategies. I have mine set to 7 days daily, once a week for 4 weeks, and twice a year. It uses some fancy compression magic and this ends up taking far less space than you'd think. ---------------------------------------------------------------------- nightmareFluffy · 2023-12-22 21:19 Good tips, thanks! The key thing I'm getting here is to isolate the backup thing as much as possible. I think I can do that. I'm probably not going to use a VM for that; I don't really see a benefit for my own use case. The backup itself can live on a Synology NAS that's quite well isolated. I think I will have to expose an https port on the NAS at least for the login, so I can manage it somehow. And an ftp port (or some other protocol). If it's only those two ports, it should be okay. ---------------------------------------------------------------------- flicman · 2023-12-22 21:24 Love that. I'm basically just going to do that next week rather than work and hopefully have it all sorted before the new year. ---------------------------------------------------------------------- adamshand · 2023-12-22 21:34 If I was in the situation (assuming no specific legal issues with moving business data onto personal hardware), I would totally back up like this. You are right to be worried about viruses being able to move back and forth between the NAS. I would make sure that any business data on the NAS is partitioned on it's own volume that nobody that you can reach. Also depending on your NAS and budget, you can get systems that scan all files for virus before writing files to disk As far as ransom ware, a copy on a remote NAS is a great step, but it's not enough. You need versioned backups somewhere that ransomeware can't get to it. You never, ever want to be in the situation where the best option you have is to pay the ransom. ---------------------------------------------------------------------- Other-Technician-718 · 2023-12-22 22:29 If that malware is encrypting everything I'll notice the long running backup / slow internet at home (8TB of data over a LTE internet line with approx. 20MBit in a more rural area) :D And I keep several weeksbof daily backups, a year weekly, and several years of monthly backups in both places. Those backups are deduplicated so they don't need that much more space unless everything changes (at first the space of my office backup will run out). ---------------------------------------------------------------------- PovilasID · 2023-12-23 09:52 1. Pull not send. The server that may be more vulnerable (home) pulls data from work server this way you limit the vulnerable service and can block all ports or access on your home PC. Work NAS can not access home NAS even if wants too. 2. Intrusion detection. There are good intrusion detection tools like suricata or soemthing like wazuh. 3. Encrypted storage. Keep the encryption keys for it NOT on the same machine. I mean you can do more but seams like overkill... though there is one thing that I was thinking of trying. HDD swap. Since my backup system if small if I buy some extra drives and just mirror what I know stable working solution and just put them in shelf... it would allow to do a fast unplug re plug a few drives swap over very quickly restoring working systems without rebuilding arrays redownloading reinitializing etc... Massive overkill and have not actually tested it... but if I free HDDs I think I would try it.