[SOLVED] Ransomware protection?

[Kurgan]

I have just read the documentation about the new PBS, and I am concerned about ransomware (or worse, attacks that are carried on by humans, that are far more intelligent that automated ransomware). The backup model is "push", i mean, the client machine (the one that is being backed up) accesses the server and "sends" its backup to it. The client machine can also delete old backups (all of them) with a simple command. This means that an attacker that has control on the client machine can easily erase all of the backup data before encrypting the data on the client machine. This is definitely not a nice scenario, and this is why I use only backup systems that work in "pull" mode, where the backup server "pulls" backups from the client machines.

Is there a way to set up PBS so that the client machine cannot delete previous backups at all? (pruning or manual deletion can always be done only from the PBS server)

 

[tom]

Is there a way to set up PBS so that the client machine cannot delete previous backups at all?

yes, just set the permission for the backup client access.

 

[t.lamprecht]

The available roles are here: https://pbs.proxmox.com/docs/administration-guide.html#access-control

EDIT: see also the now existing chapter on ransomware protection.

 

[Kurgan]

Thanks a lot. So if I get it right, the DataStoreBackup role allows for backups to be made and restored but not deleted in any way?

 

[t.lamprecht]

Thanks a lot. So if I get it right, the DataStoreBackup role allows for backups to be made and restored but not deleted in any way?

Exactly.

 

[Trulli]

Being unable to delete a backup results in a error / unsuccessful backup message within PVE.

the Backup itself seems to be ok though.
I had to change permissions to get rid of this as a workaround.

 

[t.lamprecht]

Being unable to delete a backup results in a error / unsuccessful backup message within PVE.

the Backup itself seems to be ok though.
I had to change permissions to get rid of this as a workaround.

Maybe you've not set the "maxfiles" of the PVE storage entry explicitly to 0? As else it tries to prune backups to enforce max files setting.

 

[Trulli]

Maybe you've not set the "maxfiles" of the PVE storage entry explicitly to 0? As else it tries to prune backups to enforce max files setting.

Yeah I did set it not to zero
(Eventually disable the setting in PvE, but may still be a legit option in some cases ?)

 

[t.lamprecht]

(Eventually disable the setting in PvE, but may still be a legit option in some cases ?)

We're working on integrating the more elaborate pruning of the Proxmox Backup Server also in Proxmox VE:
https://lists.proxmox.com/pipermail/pve-devel/2020-July/044307.html
Having an easily accessible "no prune at all" checkbox could make sense then.

 

[Kurgan]

So, to sum it up: Set up an user that has the DataStoreBackup priviliege, use it for backups from PVE (or from the backup agent on a phisical machine) and obviously do not try to set a pruning schedule on the client machine (PVE or phisical) because it will fail. Use pruning rules on the PBS server.