Linux Hardened Repository vs Storage Snapshots

[alojzije]

Hello everybody,

I was wondering if anybody had insights for Linux Hardened Repositories (LHR) vs Storage Snapshots?

Currently we are using NFS shares from netapp in a SOBR as our local backup repository. I am looking into hardened repositories but I am worried about the performance degredation going from NFS to going through a VM.

If the idea is somebody can't go into your backups and delete the backups. So let's say without immutability, they get into my backup server and delete my backups. I then restore from storage snapshot as they don't have access to my storage. If they did have access to my storage, they would be able to delete my LHR anyways.

I guess what I am thinking about is I can essentially achieve the same thing (although more hassle having to restore from storage snapshot), than having LHR and have a loss in performance?

Or am I missing something? Or if I am not, but there I am thinking about this the wrong way, please let me know!

[Regnor]

The recommendation is to use a dedicated physical server with local disk space for the LHR. This can be locked down to a point where no remote access is possible and therefore no attacker can wipe it's storage.

Using a virtual machine with external storage increases the attack surface too much. One could go via the hypervisor or the storage system to access your backups. That's why the security you gain will be less than with a physical server.

Storage snapshots can be a part of your backup/security strategy. But how do you prevent someone wiping the Netapp itself?

[Andreas Neufert]

As Regnor shared, to use a VM that sits on a volume is not helpful as you can destroy the volume on the storage system or the VM and potentially loose all the data. The attack vector is too high.

Linux Hardened Repository was designed for standalone servers where you do not have any access to the system or management platform itself (you can not just delete the raid remotely).
It would have as well positive side effect that you can use block cloining which reduces the IO demand dramatically on the backup target and save some space.

For NetApp ONTAP storage, you can in theory use their new Snapshot Immutability capabilities (see latest OS releases). Enable it in the compliance mode that even the Storage Admin can not delete the snapshots.
If you schedule the snapshots outside of the backup window (when our backup files are closed), this would be a good option for you.