I back up her VPS every night with rsync to a storage box at another provider and it works perfectly and I do not understand why people pay for fancy backup solutions when rsync exists!
Backup strategy: I just rsync to another provider's storage
Elena said:
I back up her VPS every night with rsync to a storage box at another provider and it works perfectly and I do not understand why people pay...
That is cool but what if your provider gets compromised and they grab your credentials from your main box. You have 2FA on that storage account or what
world record: 4min Arch install
Sorry if this is a dumb question! But isnt your ssh key on the source server a single point of failure too? What if someone gets root there
Api keys in env files are the real threat.
Lost backups once. Now use 3-2-1. Ticket open. Waiting.
world record: 4min Arch install
Dig +short hosthatch.com returns 185.x.x.x. TTL 300. Check your resolver: some ISPs cache longer than advertised. Propagation matters when you failover. Your rsync target hostname could point elsewhere during compromise window.
Your backup strategy has a credential topology problem, not a tooling problem. For what it's worth, SPF and DKIM protect mail integrity but backup integrity requires hardware tokens or at minimum asymmetric keys with the private half air-gapped. Your 2FA on the storage panel does nothing if the API key on the source server is exfiltrated. A compromised machine with your rsync cron can overwrite good backups with garbage or delete them via --delete. Seen this with compromised WordPress hosts that had "secure" offsite rsync.
SPF, DKIM, DMARC — holy trinity ✉️
How do you air-gap a key on a live vps?
world record: 4min Arch install
You don't. You air-gap the key off the VPS. Generate a keypair on a local machine, keep private key on a YubiKey or offline disk. Push from the VPS using the public key only for encryption, or pull from a separate orchestration host that holds the private key. The cron job on the compromised server should not be able to initiate destructive operations.
SPF, DKIM, DMARC — holy trinity ✉️
I see the point about --delete but I run rsync without it and I keep 30 days of snapshots on the storage box. If someone gets root on my VPS they can stop the backups but they cannot erase what is already there. That is good enough for me.