Re: [gentoo-user] {OT} backups... still backups....

[Joseph]

On 06/29/13 16:42, Grant wrote:
>Remote, automated, secure backups is the most difficult and
>time-consuming Gentoo project I've undertaken.
>
>Right now I'm pushing data from each of my systems to a backup server
>via rdiff-backup.  The main problem with this is if a system is
>compromised its backup is also vulnerable.  Also, you can't restrict
>rdiff-backup to a particular directory in authorized_keys like you can
>with rsync, and rdiff-backup isn't very good over the internet (I've
>had trouble on sub-optimal connections) and it's recommended on the
>mailing list to use rdiff-backup either before or after rsync'ing over
>the internet.
>
>We've discussed this vulnerability here before and it was suggested
>that I use hard links to version the rdiff-backup repository on the
>backup server in case it's tampered with.  I've been studying hard
>links, cp -al, rsnapshot (which uses rsync and hard links), and rsync
>--link-dest (which uses hard links) but I can't figure out how that
>would work without the inevitable duplication of data on a large
>scale.
>
>Can anyone think of an automated method that remotely and securely
>backs up data from one system to another, preserves permissions and
>ownership, and keeps the backups safe even if the backed-up system is
>compromised?
>
>I did delve into bacula but decided it was overkill for just a few systems.
>
>- Grant

You did not tell us what are you trying to backup; entire system or just particular files.
Are you afraid of updates or data loss?

I have two machine in remote location as well.  So I usually upgrade my local machine first, wait one week and if there are no surprises I upgrade remote main server 
first.  If everything goes OK (no surprises and/or complains), I upgrade remote backup machine. 

I run "vpn" so I just use rsync over vpn to make an incremental backup daily (Mon. to Fri.).

-- 
Joseph