Ransomware protected offsite copy with PBS

[sbarmen]

Hey community, we are (my company and my team) developing a ransomware safe offsite protection solution for my customers and I have made a this design to explain it:



The basic principle is that we separate as much as possible. Right now I want to use TLS with firewall blocking to ensure 1-1 communication only on the API port (8007) and the encryption is there in two layers, both the encrypted backup data and the TLS "tunnel". Both sides have static IPs so that should work. If a customer does not want to expose the API port to us, then we need to add IPSec or Wireguard VPN as an option.

Here is a full blog post writeup of the concept: https://www.sbarmen.no/posts/ransomware-safe-offsite-backups-pbs/

I have this setup in my lab for now and it works perfectly. Next step is building it into our service delivery rig as a customer offering. In that offering I will also store the datastore on NFS with immutable snapshots as an option.

What do you gents think about this approach? Am I on the right track? Any suggestions?

 

[Johannes S]

All in all a sensible approach. I would also close port 8007 on the remote for your local infrastructure though. Because then even if a bad actor managed access to all local nodes including the PBS and has a working PBS exploit he can't do anything on the remote PBS.
For restore you could have some way to temporay open port 8007. I would also use a dedicated VPN (wireguard link or something like that) for the communication between the nodes.

 

[sbarmen]

Thanks for the response @Johannes S this is valuable. I will rethink the restore part. There is no issues asking the customer to call us to open the port/access in case they need a restore. Only downside is in the odd situation where this is urgently needed in the middle of the night. I will rethink this and discuss with the team. We have a 24x7 so it could work ...

We have also discussed VPN. We could do that but is it strictly needed? The setup has 2 layers of encryption at the moment, adding VPN is even one more layer.

In case the customer does not have a static IP, or they cannot expose the API to us we will run a wireguard client on the customers PBS to open a tunnel for us to pull the data over. We could of course use this as the preferred method, and then use firewall on our side to control access to the API and block all other ports.... (Rambling on here.... )

 

[Johannes S]

Imho not being able to access the remote PBS is the only way to avoid getting hurt by privilege escalation for the read-only token.
In theory S3 storage might also work ( since many cloud storage providers allow limiting access to append-only ) but I'm not sure whether PBS support this.

 

[sbarmen]

Append only does not work unless you accept limitless growth on the S3 bucket. You have to tune prune and GC.

I think you are right though. Will rework the design with my team and build that into the process.

Will also update the article. Thanks again!