hardened Linux repository

[mporliod]

Hello everyone, I wanted to ask some questions about this new feature that I would like to implement.
To have a minimum of data security from a ramsoware attack, does it make sense to activate immutability for a period of less than 1 month?
Should the retention of the backup be greater than or equal to that of the immutability?
do you advise me to make the first copy on a nas and the second on the hardened repository or the opposite?

[veremin]

Should the retention of the backup be greater than or equal to that of the immutability?

Immutability on hardened Linux repository serves the purpose of protecting most recent backups from deletion or modification. Even the UI label suggests the proper immutability period configuration - "Make recent backups immutable" check box. So immutability period should be normally less than job retention.

do you advise me to make the first copy on a nas and the second on the hardened repository or the opposite?

It depends on your requirements - you can simply imagine the worst scenario and see if you can tolerate it.

Say, immutability is enabled only on secondary repository, in this case malicious insider or malware can remove primary backups, sure you can leverage secondary copies, but they will have a time lag compared to primary backups (as they are created less frequently). Will it be OK to restore infrastructure to yesterday's state or will you need something better than this?

Those are simply questions you can ask yourself to better form your backup infrastructure.

Thanks!

[mporliod]

If I understand correctly, immutability only makes sense on the most recent data and not on very long retention.
I need your advice, I have two repositories available, a hardened server and a nas.
I would make the first copy on the serverhardened with 21 restore points and immutability on 14 restore points, does it make sense?
On the nas what kind of job backup do you recommend? with what retention?

[Mildur]

If I understand correctly, immutability only makes sense on the most recent data and not on very long retention.

As an additional Note.
If you configure GFS for your backup jobs (or backup copy jobs) pointing to the linux hardened Repo, each GFS Restore Point is immutable for their entire retention period. GFS Restore Points will ignore the configured immutable period in the backup repository settings.
Only exception, if you use it in a SOBR with "Capacity Tier with enabled Move Policy". Then gfs restore points will use the configured immutable period.

On the nas what kind of job backup do you recommend? with what retention?

Use a Backup Copy Job with GFS Retention. How long the Retention must be, is something for you to decide, depending on your businesses requirements.
If you must use a NAS, I recommend to use a reFS formated iSCSI LUN mounted to a windows server 2016/2019/2022 instead of CIFS or NFS.

[veremin]

If I understand correctly, immutability only makes sense on the most recent data and not on very long retention.

Correct, unless we are talking about archival storage suitable for long-term restore points (GFS).

In this case it will not make a lot of sense to protect yearly backups for two weeks, but it will - to protect them for the duration of their life.

I would make the first copy on the serverhardened with 21 restore points and immutability on 14 restore points, does it make sense?

Yes, it does.

On the nas what kind of job backup do you recommend? with what retention?

It depends on your requirements as well - how often secondary copies should be created, how long they should be preserved, etc.

Thanks!

[mporliod]

On the hardened repository can I also do some copy job and gfs?
in this case if you wanted to historicize on the nas what advice would you give me?
what kind of job do you recommend?

are there cases in which the hardened server is used to historicize the data? or doesn't it make sense?

thank

[veremin]

Hardened repository support backup copy jobs, but it does not make sense to point both primary and secondary jobs to the same physical box, as it will be a single point of failure. Backup copy jobs with GFS retention scheme enabled is the best way to preserve long-term data.

It might be worth reading the corresponding user guide sections to get a better idea on what certain feature might give to you.

Thanks!

[mporliod]

Good morning here is my project, I would like to use a physical server with RHEL 8.2 on board as a second backup repository.
source data= 15 TB
number of virtual machines = 80
restore point= 21
backup copy job with GFS 1 week
change rate = 10%
data left after reduction = 50%
Reflink" (Fast Clone in Veeam) functionality with the XFS file system

I have some doubts that I would like to understand:
If I want to protect my 21 restore points, do I have to set immutability at 21 days ?
by activating this policy backup copy job with GFS 1 week does this mean that apart from the first full one, I have another 3 full backups? are they active full or synthetic full backup?
I'm not sure about the size of the disk space for the repository, I did the calculation with two different tools, in your opinion 'is the space correct for 35 tb?

thank !!!

[veremin]

Actually, it's recommended to set an immutability period shorter than the retention policy to protect only the most recent backup chains (two weeks in most cases).

As to the GFS creation mode, it will depend on how you configure backup copy job.

And we cannot comment on your space estimations without seeing the tool you are referring to

Thanks!