Re: Remote Client Security Alerts

Bill Arlofski via Bacula-users <[email protected]> Tue, 17 Sep 2024 14:07:10 +0000

Newsgroups	gmane.comp.bacula.user
Message-ID	<[email protected]>

On 9/17/24 4:41 AM, Chris Wilkinson wrote:
> I keep getting security alerts from a remote client backup. The backups always run to success. The IPs that are listed in the 
> job log are different every time and in various locations including some in Russia but also in London and European data 
> centres. There are no entries at all in the remote client bacula log. This only happens with remote client backups, never 
> with local client backups.
> 
> It's not clear to me whether these alerts are coming from the DIR or being sent to the Director by the client.
> 
> I'm not sure whether to just ignore these or take some steps to block them. Is there an FD directive that would reject these 
> perhaps?
> 
> Any advice welcomed.
> 
> Thanks
> 
> -Chris Wilkinson

Hello Chris,

Since this FD "nuc2" is (obviously) exposed to the Internet, I would enable the firewall on it, and only allow connections in 
from the Director on port 9102/TCP (default).

Best/safest way IMHO.



Best regards,
Bill

-- 
Bill Arlofski
[email protected]

_______________________________________________
Bacula-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bacula-users

signature.asc (application/pgp-signature, 509 B)