71–80 of 94 posts
I don't know what the OP is running OS wise but if it's any modern Unix variant it uses ZFS. And a simple ZFS send/receive would be perfect. There are tons of scripts for that and replication. If you're not using a modern Unix variant with ZFS... well there isn't a good reason why you would be.
For database, I use a second VPS running as a read only slave. A script runs daily to create database backups on the VPS.
Earlier quoted context omitted.
Which is literally the worst scenario. An attacker owns your box and now your backups.
How do you avoid that with any backup service?
My backup system involves my data storage system reaching out to each machine I want to backup and fetching the data locally.
All I need for that is to put my storage system's public key on the machines, and I'm fine with an attacker getting that.
I see lots of great suggestions for backup hosts and methods, but I don't see anybody addressing encrypting said backups. I'm uncomfortable with rsync.net / Backblaze / etc having access to my data. What are some good ways to encrypt these multiple-GB backups before uploading them to a third-party backup server?
Collect your files, rsync/scp/sftp them over.
Read only snapshots on the rsync.net side means even an attacker can't just delete all your previous backups.
[1]http://duplicity.nongnu.org/
http://mindfsck.net/incremental-backups-amazon-s3-centos-usi...
Earlier quoted context omitted.
Yep. Here is an example that I use to upload it to dropbox. I don't delete and/or gzip my oldest uploads though. #!/bin/sh DATE=$(date +%d-%m-%Y@%H:%M:%S.%3N) DB_USER="qux" DB_PASS="foo" DB_NAME="bar" DROPBOX_TOKEN="baz" /usr/bin/mysqldump -u${DB_USER} -p${DB_PASS} ${DB_NAME} > /tmp/${DATE}.sql /usr/bin/curl -H "Authorization: Bearer ${DROPBOX_TOKEN}" https://api-content.dropbox.com/1/files_put/backup/ -T /tmp/${DATE…
Careful! If someone hacks your server, they now get your Dropbox account. One alternative is to put these backups into S3 using pre-signed requests rather than Dropbox. An S3 pre-signed request gives permission only to upload files, perhaps only to a certain location in a certain bucket. It's a bit harder to set up, but the shell script will look almost the same.
I can't praise restic enough. It's fast, secure, easy to use and set up (golang) and the developer(s) are awesome!