Hacker News Reader

Comment by Mo3 | Hacker News Reader

I have to say, this is an excellent solution and I am seriously contemplating on deploying it for all of our servers.

I'm a little unclear on one thing, are alternative S3 providers supported?

These seem to be the supported backends

    Local directory
    sftp server (via SSH)
    HTTP REST server (protocol, rest-server)
    Amazon S3 (either from Amazon or using the Minio server)
    OpenStack Swift
    BackBlaze B2
    Microsoft Azure Blob Storage
    Google Cloud Storage
    And many other services via the rclone Backend

https://github.com/restic/restic#backends=

I saw that, I was specifically wondering about different regular S3 implementations like Linode object storage, Digitalocean spaces, Wasabi, etc

Did you try your back end to see if it works? It's not that hard to download the executable and try it.

Yes, just now. Here's the piece of information I was looking for - rclone supports S3

Yes! I back up directly into Backblaze B2 using restic.

Excellent. One more question. Assuming someone gains access to a node - will they be able to access the backups or screw with them in any way?

Depends which back-end you use and which configuration. (Assuming "node" here means a backup client and not a backup-hosting server.)

If you just put stuff on some standard storage (FTP, B2, etc.) without any permissions set up, then no backup client could stop the attacker from using the credentials you've deployed to the backup client to login to your storage and delete your backup files. This is not really specific to restic.

Accessing old files from a backup client is a weakness. Though, personally, I don't store things on a system that this system is not supposed to know, so if someone compromises this system and they see data from the past year... that's nearly the same as just seeing the data that is on this system today. Nevertheless, this could be solved by using public keys, so the backup clients has an encryption but no decryption key (of course it's not as trivial as this sounds, e.g. how could it still do deduplication etc.), but restic does not do this.

Got it. So I guess the best solution to go forward here would be to deploy Minio and then backup the backup directory itself in regular intervals onto different storage not accessible from anywhere.

There's an object lock feature which prevents objects in a certain bucket from being deleted before X amount of time has elapsed. This might be able to prevent backups from being tampered with.

If that doesn't work, there's a restic server which can act as an intermediary and which has an append-only mode which would prevent backups from being tampered with if your computer were compromised.

Reply on news.ycombinator.com