Re: Backup Best Practice

--0000000000007d69b8062a422866
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

You really want immutability on your offsite location. If you=E2=80=99re sm=
all (<a
few hundred tb=E2=80=99s), a single Linux box with zfs and snapshots would =
suffice.
Pull backups from your Amanda node, and disable outside access to the host.
Disconnect ilo/idrac, disable ssh.

The plan reaches further than just where you store your files. Think of a
worst case scenario where a hacker has had all your credentials for a few
months, and also compromised the it team=E2=80=99s 2fa store on their mobil=
es. And
now they=E2=80=99re ready to hit the delete button. ;)

Angelo.

On Fri, 27 Dec 2024 at 11:23, Charles Curley <
[email protected]> wrote:

> On Fri, 27 Dec 2024 20:03:31 +1100
> duluxoz <[email protected]> wrote:
>
> > Hi All,
> >
> > We're trying to follow backup best practice (ie the 3-2-1 Rule: 3
> > backups on 2 different media, 1 off-site). My question is: What's the
> > best way to achieve this:
> >
> >  1. Run three identical backups to each of the three destinations
> >  2. Run a single backup and use something like scp or rsync to copy
> > the resulting backup files to the other two destinations
> >  3. Or can Amanda backup to multiple destinations at once, and if so,
> >     how is this accomplished
>
> So far as I know, amanda does not do 3. I do a variant on 2.
> https://charlescurley.com/blog/posts/2019/Nov/02/backups-on-linux/
>
> --
> Does anybody read signatures any more?
>
> https://charlescurley.com
> https://charlescurley.com/blog/
>

--0000000000007d69b8062a422866
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">You really want immutability on your offsite location. If=
 you=E2=80=99re small (&lt;a few hundred tb=E2=80=99s), a single Linux box =
with zfs and snapshots would suffice. Pull backups from your Amanda node, a=
nd disable outside access to the host. Disconnect ilo/idrac, disable ssh.=
=C2=A0</div><div dir=3D"auto"><br></div><div dir=3D"auto">The plan reaches =
further than just where you store your files. Think of a worst case scenari=
o where a hacker has had all your credentials for a few months, and also co=
mpromised the it team=E2=80=99s 2fa store on their mobiles. And now they=E2=
=80=99re ready to hit the delete button. ;)</div><div dir=3D"auto"><br></di=
v><div dir=3D"auto">Angelo.</div><div dir=3D"auto"><br><div class=3D"gmail_=
quote gmail_quote_container" dir=3D"auto"><div dir=3D"ltr" class=3D"gmail_a=
ttr">On Fri, 27 Dec 2024 at 11:23, Charles Curley &lt;<a href=3D"mailto:cha=
[email protected]">[email protected]</a>&gt; wrote=
:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;bor=
der-left:1px #ccc solid;padding-left:1ex">On Fri, 27 Dec 2024 20:03:31 +110=
0<br>
duluxoz &lt;<a href=3D"mailto:[email protected]" target=3D"_blank">duluxoz@=
gmail.com</a>&gt; wrote:<br>
<br>
&gt; Hi All,<br>
&gt; <br>
&gt; We&#39;re trying to follow backup best practice (ie the 3-2-1 Rule: 3 =
<br>
&gt; backups on 2 different media, 1 off-site). My question is: What&#39;s =
the <br>
&gt; best way to achieve this:<br>
&gt; <br>
&gt;=C2=A0 1. Run three identical backups to each of the three destinations=
<br>
&gt;=C2=A0 2. Run a single backup and use something like scp or rsync to co=
py<br>
&gt; the resulting backup files to the other two destinations<br>
&gt;=C2=A0 3. Or can Amanda backup to multiple destinations at once, and if=
 so,<br>
&gt;=C2=A0 =C2=A0 =C2=A0how is this accomplished<br>
<br>
So far as I know, amanda does not do 3. I do a variant on 2.<br>
<a href=3D"https://charlescurley.com/blog/posts/2019/Nov/02/backups-on-linu=
x/" rel=3D"noreferrer" target=3D"_blank">https://charlescurley.com/blog/pos=
ts/2019/Nov/02/backups-on-linux/</a><br>
<br>
-- <br>
Does anybody read signatures any more?<br>
<br>
<a href=3D"https://charlescurley.com" rel=3D"noreferrer" target=3D"_blank">=
https://charlescurley.com</a><br>
<a href=3D"https://charlescurley.com/blog/" rel=3D"noreferrer" target=3D"_b=
lank">https://charlescurley.com/blog/</a><br>
</blockquote></div></div>

--0000000000007d69b8062a422866--