1 |
A little while ago I set up an automated backup system to back up the |
2 |
data from 3 machines to a backup server. I decided to use a |
3 |
push-style layout where the 3 machines push their data to the backup |
4 |
server. Public SSH keys for the 3 machines are stored on the backup |
5 |
server and restricted to the rdiff-backup command. Each of the 3 |
6 |
machines pushes their data to the backup server as a different user |
7 |
and the top directory of each backup is chmod 700 to prevent any of |
8 |
the 3 machines from reading or writing a backup from another machine. |
9 |
|
10 |
I've run into a problem with this layout that I can't seem to solve, |
11 |
and I'm wondering if I should switch to a pull-style layout where the |
12 |
backup server pulls data from each of the 3 machines. |
13 |
|
14 |
The problem with my current push-style layout is that if one of the 3 |
15 |
machines is compromised, the attacker can delete or alter the backup |
16 |
of the compromised machine on the backup server. I can rsync the |
17 |
backups from the backup server to another machine, but if the backups |
18 |
are deleted or altered on the backup server, the rsync'ed copy on the |
19 |
next machine will also be deleted or altered. |
20 |
|
21 |
If I run a pull-style layout and the backup server is compromised, the |
22 |
attacker would have root read access to each of the 3 machines, but |
23 |
the attacker would already have access to backups from each of the 3 |
24 |
machines stored on the backup server itself so that's not really an |
25 |
issue. I would also have the added inconvenience of using openvpn or |
26 |
ssh -R for my laptop so the backup server can pull from it through any |
27 |
router. |
28 |
|
29 |
What do you think guys? Are push-style backups flawed and unacceptable? |
30 |
|
31 |
- Grant |