Hi,
I have some questions about replication, and I want to confirm my understanding and any caveats before I set it up. My main purposes for setting this up are:
- Offsite backup to multiple locations
- Protection against malware (i.e. defense against a cryptolocker where the remote backups should be unaffected)
Some things I want to make sure:
- The main server cannot remove or edit any snapshots from the remote backup servers (would nullify the cryptolocker part). It should only be able to add new snapshots.
- The remote backup servers cannot actually access the data (not all are in as secure of locations). It should remain encrypted in transit and at rest without intervention/unlocking at the backup server.
- Neither servers have root access to each other
- Ideally, neither server even has remote shell access to each other, but that seems unlikely to be possible
So, given all of that, is this possible?
It looks like the SSH connection can be go either direction, and each direction has different implications:
- Backup server connects to main server
- Backup server could access unencrypted data when pools are unlocked
- Backup server (in less secure location) has a shell on the main server
- Main server connects to backup server
- If the main server is compromised, could it delete snapshots on the remote backup server?
Thanks!
You can configure each backup server with a pull replication. If anyone gains access to your main server, they will not have the credentials to access the backup servers.
This used to be possible with scponly, but it has been removed. I doubt you’ll need to harden your servers that much though.
Neither server needs root user access to the other to be able to send or receive replications.
This is possible if the source dataset is encrypted and you use “raw” streams. Raw streams are automatically used if “include properties” or “full filesystem” are enabled in the task’s config.
Unlocked where? Unlocked on the backup server? You’d have to manually unlock them if you’re using raw streams. They will not be automatically unlocked during or after replication.
1 Like
Thank you very much for the quick response! I see, I will go for the pull method where the backup devices connect to the main server.
I mean that if a dataset is unlocked on the main server, and a backup server is SSHing into the main server, then it could theoretically access the data in the unlocked dataset. I supposed this could be prevented by disabling scp/rsync for the backup user and either disabling its shell or allowing it to only use a subset of commands. Can I limit it to only the commands it needs? Does TrueNAS document which SSH permissions/shell commands are required so I can sandbox it as much as possible?
