How should I protect access to a dedicated backup repository server?
A repository server should limit what each client can read, write and remove. Separate ordinary client ingestion from retention administration and restore authority where the chosen software supports it. A reachable copy is not protected from a compromised client unless its access rights enforce that boundary.
Before you start
- The repository product/version, client inventory and approved retention and recovery requirements.
Instructions
1. Define per-client access
Use distinct credentials and scope each client to its own repository or authorised data. Avoid giving application servers unrestricted shell or repository-wide administrator access. With SSH-based products, review supported restricted commands and path restrictions rather than exposing a general-purpose login unnecessarily.
2. Check the exact protection semantics
Read the installed product’s meaning of append-only, immutable or restricted access. For example, Borg’s documented append-only mode protects underlying segment modification but still permits some logical delete/prune operations; it should not be described as preventing every visible deletion. Ensure the recovery procedure matches the actual storage behaviour.
3. Verify administration and restoration
Keep retention changes and destructive maintenance with separately authorised operators, and log their actions. Test existing repository integrity and restore access from a trusted recovery environment. Protect encryption keys independently and check that losing a client or its credentials does not prevent an authorised recovery.
Check the result
- A client cannot access another client’s repository or perform unauthorised destructive maintenance.
- The recovery team can validate and restore an existing point using the documented protection model.
Troubleshooting
- Restricted access prevents a required maintenance task
- Identify whether the task belongs to a separate repository administrator. Do not give every ingestion client unrestricted access merely to simplify retention maintenance.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.