Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BorgBackup 2 has no server-side append-only anymore

github.com

Post reply on HN
Print view View original

1–10 of 119 posts

Re: BorgBackup 2 has no server-side append-only anymore

#4

Post by philsnow »

LeoPanthera wrote: post #2

Is that a big deal? You should probably be doing this with zfs immutable snapshots anyway. Or equivalent feature for your filesystem.

The purpose of the append-only feature of borgbackup is to prevent an attacker from being able to overwrite your existing backups if they compromise the device being backed up.

Are you talking about using ZFS snapshots on the remote backup target? Trying to solve the same problem with local snapshots wouldn't work because the attack presumes that the device that's sending the backups is compromised.

Re: BorgBackup 2 has no server-side append-only anymore

#7

Post by ajb »

topato wrote: post #3
LeoPanthera wrote: post #2

Is that a big deal? You should probably be doing this with zfs immutable snapshots anyway. Or equivalent feature for your filesystem.

I'm also completely confused why this was at the top of my hacki, seems completely innocuous

Ideally a backup system should be implementable in such a way that no credential on the machines being backed up, enable the deletion or modification of existing backups. That's so that if your machines are hacked a) the backups can't be deleted or encrypted in a ransom attack and b) If you can figure out when the first compromise occurred, you know that before that date the backup data is not compromised.

I guess some people might have been relying on this feature of borgbackup to implement that requirement

Re: BorgBackup 2 has no server-side append-only anymore

#8

Post by LeoPanthera »

philsnow wrote: post #4
LeoPanthera wrote: post #2

Is that a big deal? You should probably be doing this with zfs immutable snapshots anyway. Or equivalent feature for your filesystem.

The purpose of the append-only feature of borgbackup is to prevent an attacker from being able to overwrite your existing backups if they compromise the device being backed up. Are you talking about using ZFS snapshots on the remote backup target? Trying to solve the same problem with local snapshots wouldn't work because the attack presumes that the device that's sending the backups is compromised.

> Are you talking about using ZFS snapshots on the remote backup target?

Yes.

Re: BorgBackup 2 has no server-side append-only anymore

#9

Post by homebrewer »

For anyone looking to migrate off borg because of this, append-only is available in restic, but only with the rest-server backend:

https://github.com/restic/restic

https://github.com/restic/rest-server

which has to be started with --append-only. I use this systemd unit:

  [Unit]
  After=network-online.target

  [Install]
  WantedBy=multi-user.target

  [Service]
  ExecStart=/usr/local/bin/rest-server --path /mnt/backups --append-only --private-repos
  WorkingDirectory=/mnt/backups
  User=restic
  Restart=on-failure
  ProtectSystem=strict
  ReadWritePaths=/mnt/backups
I also use nginx with HTTPS + HTTP authentication in front of it, with a separate username/password combination for each server. This makes rest-server completely inaccessible to the rest of the internet and you don't have to trust it to be properly protected against being hammered by malicious traffic.

Been using this for about five years, it saved my bacon a few times, no problems so far.

Re: BorgBackup 2 has no server-side append-only anymore

#10

Post by homebrewer »

LeoPanthera wrote: post #2

Is that a big deal? You should probably be doing this with zfs immutable snapshots anyway. Or equivalent feature for your filesystem.

There's not much sense in using these advanced backup tools if you're already on ZFS, even if it's just on the backup server, I would stick with something simpler. Their whole point is in reliable checksums, incremental backups, deduplication, snapshotting on top of a 'simple' classical filesystem. Sounds familiar to any ZFS user?
Post reply on HN