Use case

Off-site backups over SFTP that a hacked server can't delete

Back up with a login that can add files but not delete or replace them, on top of a versioned bucket you own.

Start 7-day free trialRead the docs

The problem. Sound familiar?

  • Ransomware that reaches a server goes for the backups next, using the credentials the backup job already has.

  • A backup target that accepts deletes and overwrites from the client is only as safe as that client.

  • A hardened off-site backup box is one more server to patch and monitor.

How it works with CloudFile, in about a minute.

  1. Step 1

    Connect a versioned bucket

    Turn on versioning in your own S3-compatible bucket, and object lock if your provider supports it, then use it for the server.

    backups → s3://acme-backups versioning ✓ object lock ✓
  2. Step 2

    Add a login without delete

    Start from the Upload only preset and add Rename. The user can add new files but can't delete or overwrite anything.

    web-01 list upload rename create_dirs ✗ delete ✗ overwrite
  3. Step 3

    Point your backup tool at it

    rclone copies new files only. restic, Duplicati and Arq write their own repositories, protected by the bucket's versions.

    rclone copy /var/backups cloudfile:web-01 --ignore-existing

What you get, and nothing you have to run.

  • No delete, no overwrite

    Permissions are set per user. Without Delete and Overwrite, a login can add files and rename them to new names, but can't remove or replace anything.

  • Versioning in your bucket

    With versioning on, a delete over SFTP only adds a delete marker and an overwrite adds a new version. Earlier versions stay in the bucket.

  • Object lock, if supported

    Amazon S3, Backblaze B2 and Wasabi support object lock. In compliance mode, locked versions can't be removed before the retention period ends, by anyone.

  • One key per machine

    Give every machine you back up its own user and SSH key, so a leaked key exposes one folder, not all of them.

  • Upload notifications

    Get an email or a webhook for every upload, so you can check that last night's backup arrived.

  • Off-site, in the EU

    Servers run in Germany, and your bucket stays in whichever provider and region you chose.

Back up with rclone and restic. rclone for plain files, restic through rclone for snapshots.

# An rclone remote for the backup user (host and port are on the server's Overview tab)
rclone config create cloudfile sftp \
  host nbg1.cloudfile.dev port 22000 user web-01 \
  key_file ~/.ssh/cloudfile_backup set_modtime false

# Database dumps and other plain files: upload new files, never touch existing ones.
# Needs List, Upload, Rename and Create folders.
rclone copy /var/backups/db cloudfile:db --ignore-existing

# restic snapshots through the same remote. restic also reads its index and
# deletes its own lock files, so this user needs Download and Delete too.
export RESTIC_REPOSITORY=rclone:cloudfile:restic
export RESTIC_PASSWORD_FILE=/etc/restic/password
restic init
restic backup /etc /home /var/www

Questions about this setup.

Is this really ransomware-proof?

No single setting is. A user without Delete and Overwrite stops a compromised client from removing or replacing backups over SFTP. Versioning keeps earlier versions of every file, and object lock stops anyone from removing them before the retention period ends. Use all three for the strongest setup.

Why does restic need Delete?

restic creates and removes lock files in the repository on every run. Without Delete it still backs up, but each run waits on retries and long runs can fail to refresh their lock. Give the restic user Delete and let bucket versioning and object lock keep old data safe.

Why the rclone backend instead of restic's sftp backend?

restic's sftp backend changes file permissions after each upload, which CloudFile doesn't allow, so the upload fails. With the rclone backend (rclone:remote:path), restic talks to the same server without that step.

What about Duplicati, Arq and Synology Hyper Backup?

Duplicati and Arq can both back up to an SFTP destination. Like restic, they clean up their own files, so give them Delete and rely on bucket versioning. Synology Hyper Backup can back up to the server over WebDAV; turn WebDAV on in the server's settings.

Do I need my own bucket?

For versioning and object lock, yes. On CloudFile storage you still get users without delete or overwrite, but no versioning.

More in the docs: Users and permissions · Your own bucket · Backblaze B2

Other jobs for the same server.

Your SFTP server is one click away. Free for 7 days, no card needed.

Start your free trial