Comment by rsync | Hacker News Reader

Comment by rsync | Hacker News Reader

Parent Full thread

"I've been waiting for something I can use to backup my workstation and laptops to a server at home as well as a server I have at $work (ISP)."

borg[1] has been referred to as "the holy grail of backups"[2] and is supported at rsync.net.[3]

The end result is encrypted, zero knowledge remote backups on a ZFS filesystem that you can SSH to.

I think everyone here knows all about rsync.net, but here are some examples:[4]

  ssh user@rsync.net sha256 some/file
  pg_dump -U postgres db | ssh user@rsync.net "dd of=db_dump"
  ssh user@rsync.net du -Ahd2 some/directory

[1] https://borgbackup.readthedocs.io/en/stable/

[2] https://www.stavros.io/posts/holy-grail-backups/

[3] http://rsync.net/products/attic.html

[4] http://www.rsync.net/resources/howto/remote_commands.html

One of the nicer bits of borg is the ability to restrict it to append-only mode, which limits the damage compromised hosts can do. e.g in authorized_keys:

    command="/usr/local/bin/borg serve --append-only --restrict-to-path=/home/backup/bla",restrict ...

I use this with passphrase-free ssh keys to allow automated backups without permitting the destruction of any existing backups.

Do you get enough control do to that on rsync.net?

"Do you get enough control do to that on rsync.net?"

Yes. You have your own .ssh folder in your account and can edit (upload) your keys as you see fit.

Also, if you have our ZFS snapshots enabled, those are immutable/readonly - so even if you aren't using a sophisticated tool like borg, you still have snapshots of your data that are immune to attack - even from someone who knows all of your credentials.

Borg's encryption scheme is weak and not suited for multiple nodes using the same repo.

This isn't zero-knowledge. Please use this opportunity to educate the public instead of muddying the term for the sake of marketing buzzwords.

To add to this comment: https://paragonie.com/blog/2016/08/crypto-misnomers-zero-kno...

Your point is well taken. Thanks.

Reply on news.ycombinator.com