On 1/15/26 05:24, 04-psyche.totter@icloud.com wrote:
>
>> As others have mentioned, it will be a good idea to implement the
>> backups so that you will be pulling data from the less trusted
>> source to your backup server (the more trusted one).
>
> Thanks Lari, that's a great point. So you are basically saying I
> should not create a restricted user on the server (trusted machine),
> but instead the untrusted client should be the one providing ssh
> access to the server. the server will just pull the data from the
> untrusted client. Is that what you meant?
This is how most big "enterprise" backup systems work. Central
backup server initiates and controls the backup process, clients have
ZERO access to the backup server.
> For the recovery though, how would you envision that?
exactly the same -- the backup server pushes the data to be restored to the
remote system through the key-based ssh login, presumably to root.
Now..that does mean the remote system has to request the restoration. And
you have to perform it.
Nick.
No comments:
Post a Comment