3

I use local encrypted backup feature of Backintime on debian 8.3 to backup my files to an external drive. It automatically backups every 30 minutes. My external drive is always connected. I am the only user of this computer.

Recently I often hear about ransom-ware nightmare stories. As my backup location is always accessible, I am thinking about a way to to make my backup location safe and isolated from such attacks, as a precaution.

I thought if I run Backintime as a special "backup user" or root and use a backup location on which only "backup user" or root has write access, I would achieve this. I guess it is advisable to use root only when it is inevitable, so I think I'd prefer to create a "backup user" for this job.

I wonder if I can use file permissions for this purpose or is there a better way.

My questions:

  1. Is this a good idea to make my backup location safe?
  2. How can I run Backintime automatically as "backup user" while I use the computer with a different account at the same time?
  3. How can I assign "backup user" as the only user which has write access on my backup location?
2
  • "My external drive is always connected." - If a volume is connected then it can be encrypted by ransomware, unless you are willing not to have the external always connected, then you cannot protect yourself from ransomware.
    – Ramhound
    Mar 14, 2016 at 17:24
  • How ransomware can encrypt external drive if current user does not have write access to the external drive, or, to the backup folder in that drive?
    – Ertugrul
    Mar 14, 2016 at 20:25

1 Answer 1

1
  1. Store your backups on media that is not physically connected or normally turned on.

  2. Have multiple backup media (drives/tapes) that are rotated out on a regular basis. Bonus points for storing them off-site (at least a few miles/kilometers away). I recommend a minimum of (3) drives/tapes, with only 1 or 2 units of the set being kept onsite.

  3. Permissions to write or access the backup directory should be limited to the root account.

  4. Your day-to-day user account should not have sudo permissions. Use a second user-level account to do system administration via sudo. If you don't have the ability to elevate privileges, then you can't be tricked into elevating privileges.

  5. Dismount the backup directory when not in use using tools like autofs. That also gives the advantage that you can unplug the drive without worrying about whether the file system is mounted. The autofs tool can be configured to auto-mount the backup directory, then dismount it after a few minutes of inactivity.

  6. Use a backup tool that is efficient at storing lots and lots of incrementals (Duplicity, borg-backup). That will let you keep a year's worth of backups on each drive, giving you more possibilities to restore things to how they were prior to the event.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .