A bullet-proof backup system for small office

Utilizing ZFS, Rsync, and Samba to back up Windows systems with accessible daily snapshots is very useful for mitigating ransomware attacks and recovering from accidental file deletions.

Ingredients

• A ZFS Server with Rsync and Samba
• https://github.com/buganini/shadowsync/

With ZFS snapshots, disk space requirements are minimized. Volume Shadow Copy Service (VSS) bypasses file locks so that backups can be performed without interrupting normal usage, and rsync reduces transmission overhead.

Write-Only Rsync Folder

Create a write-only folder in your rsync.conf

[latest]
        path = /data/backup # in ZFS
        read only = no
        write only = yes
        transfer logging = yes
        hosts allow = 192.168.168.0/255.255.255.0 172.21.0.0/255.255.255.0
        #secrets files = /usr/local/etc/rsync/rsyncd.secret

Setup Backup Task in Target Computer

Follow the instructions in [shadowsync](https://github.com/buganini/shadowsync/)

Daily Snapshot

Create your script to perform

zfs snapshot backup@YYYYMMDD

Read-Only Share

Mount (read-only) snapshots in your script

mount -t zfs backup@YYYYMMDD /path/to/shared/folder/YYYYMMDD

Create read-only share in smb4.conf

[Share]
        path = /path/to/shared/folder/
        browseable = yes
        writable = no
        valid users = alice, bob

Feel free to use mount -t nullfs (FreeBSD) or mount --bind (Linux) to re-map paths

Rotation

Your script should also find out existing snapshots with

zfs list -t all

and perform rotation with umount and zfs destroy backup@YYYYMMDD

Extra Remote Backup

Remote backup is a good idea in case of physical server damage.