Comment by ChuckMcM | Hacker News Reader

Comment by ChuckMcM | Hacker News Reader

Parent Full thread

I've got a FreeNAS system built by iXSystems. It works well. But a NAS system is more expensive than a single drive. The FreeNAS box replaced a NetApp StoreVault unit.

Generally I've gone to a archive first strategy for recovery though. I didn't want to buy a tape drive to back it up (10TB usable after dual parity protection), so I write media as I get it to BD-R's and put them on the NAS box for accessibility. I also backup individual projects on their own DVD-R or BD-R. That negatively impacts 'time to reconstruct' because each source will have to be located, loaded, then verified. But it essentially means nothing on the NAS box isn't already available on shelf-stable read only media. It also means the option for recovering from a ransomware attack is to re-format and re-load. The challenge is maintaining the discipline of making the restore media first.

I probably have the same (FreeNAS Mini, right?). Quite happy with it, although it can be fiddly to set up. Has tons of features though.

In fact, as I speak I'm upgrading to 4x8TB Western Digital Red drives (I back up a number of computers, and have some large media files). Resilvering takes foreeeevveeerrr btw. (looks like about 36 hours per disk, times 4)

Would ZFS snapshots protect against ransomware?

Yes, absolutely. ZFS snapshots are immutable, such that once a snapshot is created nothing can change it (until to destroy the snapshot). Not designed to help with ransomware, but is a perfect use case they'd protect against. (You also want backups, of course).

Edit: I guess I'm assuming the ransomware doesn't have access to the raw disks, which would be true if you were using a NAS (e.g. FreeNAS) and connecting to it via NFS, CIFS, etc.

Correct, no access to FreeNAS via ssh. Ransomware would have to find a vulnerability in a service exposed by FreeBSD / FreeNAS.

On the client? Sure, as long at it doesn't grow a brain and starts to SSH into the storage and wipe that clean, too.

On the storage? Nope.

Get backups.

Curious, how/how often do you test the BD-Rs? I'd be a bit worried about their long-term stability.

Had a mass of DVD/BR for another project. The DVD where 10-15 years old with and we checked a batch half a year ago with no loss. If you are concerned for your BD you could use M-Disks https://en.wikipedia.org/wiki/M-DISC

> iXSystems

Looks like a Supermicro reseller - at least their rack offerings.

For hardware, pretty much. But they sponsor the development of FreeNAS, so they aren't just a reseller. They do add a lot to the equation.

Reply on news.ycombinator.com