Gentoo Archives: gentoo-user

From: Pandu Poluan <pandu@××××××.info>
To: gentoo-user@l.g.o
Subject: Re: [gentoo-user] {OT} Are "push" backups flawed?
Date: Fri, 11 Nov 2011 18:27:05
In Reply to: [gentoo-user] {OT} Are "push" backups flawed? by Grant
1 On Nov 12, 2011 12:58 AM, "Grant" <emailgrant@×××××.com> wrote:
2 >
3 > A little while ago I set up an automated backup system to back up the
4 > data from 3 machines to a backup server. I decided to use a
5 > push-style layout where the 3 machines push their data to the backup
6 > server. Public SSH keys for the 3 machines are stored on the backup
7 > server and restricted to the rdiff-backup command. Each of the 3
8 > machines pushes their data to the backup server as a different user
9 > and the top directory of each backup is chmod 700 to prevent any of
10 > the 3 machines from reading or writing a backup from another machine.
11 >
12 > I've run into a problem with this layout that I can't seem to solve,
13 > and I'm wondering if I should switch to a pull-style layout where the
14 > backup server pulls data from each of the 3 machines.
15 >
16 > The problem with my current push-style layout is that if one of the 3
17 > machines is compromised, the attacker can delete or alter the backup
18 > of the compromised machine on the backup server. I can rsync the
19 > backups from the backup server to another machine, but if the backups
20 > are deleted or altered on the backup server, the rsync'ed copy on the
21 > next machine will also be deleted or altered.
22 >
23 > If I run a pull-style layout and the backup server is compromised, the
24 > attacker would have root read access to each of the 3 machines, but
25 > the attacker would already have access to backups from each of the 3
26 > machines stored on the backup server itself so that's not really an
27 > issue. I would also have the added inconvenience of using openvpn or
28 > ssh -R for my laptop so the backup server can pull from it through any
29 > router.
30 >
31 > What do you think guys? Are push-style backups flawed and unacceptable?
32 >
34 No, it's not flawed, as long as the implementation is right: versioning and
35 deduplication.
37 With versioning, an attacker (or infiltrator, in this matter) might try to
38 taint the backup, but all she can do is just push a new version to the
39 server. You can recover your data by reverting to a prior version.
41 The deduplication part is only to save storage space. It's less necessary
42 if you have a robust versioning system that can categorize each push as
43 either canonical/perpetual/permanent or ephemeral/temporary. The system can
44 just discard old ephemeral pushes when storage becomes critical.
46 Rgds,


Subject Author
Re: [gentoo-user] {OT} Are "push" backups flawed? Grant <emailgrant@×××××.com>