I have two servers, both running FreeBSD 14.0-RELEASE and both hosting a number of jails. One is a dedicated server with a commercial hosting provider, and one is in my house. I refer to these as my dedicated and home servers respectively.
For my dedicated server until now my backup solution has just been to occasionally offload everything to my home server with tar and rsync, but since it is more permanent now than I had originally planned, I decided I needed something more regular and standard. I decided to set up a little scheme using ZFS replication which seems to be working just fine, but I wanted to get a second set of eyes on and make sure that I'm not overlooking something here, or if I've accidentally left a huge gaping hole that I don't see since this is my first time using ZFS for something like this.
On my home server, I set up a jail just to receive backups. There is a ZFS dataset at home/jails/backups/receive which has the
On the dedicated server, I generated a keypair that allows access to the jail (but not the host). My thinking here is that, if the key were to be compromised, then the only thing an attacker is getting access to is a backup of the server they already apparently have access to, so there's no great increase in risk (assuming they don't have some exploit for breaking out of a jail, but that's an angle that's hard to address, and one that's unlikely to be a problem anyway).
On the dedicated server's root crontab, I have two commands:
The end goal here is a a daily snapshot of my entire remote filesystem being sent to my home server (there is adequate storage space), from which I can either restore my remote server if necessary, or even use it to move jails from the dedicated server to home server if decided to do so. The receiving end, I believe, should match the snapshot structure exactly because of the -F option, meaning if I delete old snapshots on the dedicated server then at the next send they will be deleted on the backup server as well.
The only thing I still intend to do that I haven't done is update the host's firewall to block all network traffic to and from the jail's IP besides over its ssh port, in order to reduce the risk to my home server and network if the jail were to be compromised.
I might also adjust the sshd configuration on the backup jail so that it only runs the
So far it appears to be working just fine, but am I overlooking any potential problems here?
For my dedicated server until now my backup solution has just been to occasionally offload everything to my home server with tar and rsync, but since it is more permanent now than I had originally planned, I decided I needed something more regular and standard. I decided to set up a little scheme using ZFS replication which seems to be working just fine, but I wanted to get a second set of eyes on and make sure that I'm not overlooking something here, or if I've accidentally left a huge gaping hole that I don't see since this is my first time using ZFS for something like this.
On my home server, I set up a jail just to receive backups. There is a ZFS dataset at home/jails/backups/receive which has the
jailed=on property set. The backup jail configuration uses exec.created="zfs jail backups home/jails/backups/receive"; to be able to use it on jail restart, and the jail runs ssh and my home router is forwarding a nonstandard port to the jail's ssh instance. The jailed ssh service is properly secured with pki required for login, though I do allow root login over ssh on the jail in order to accommodate the backup process (I tried to use a dedicated backup user and zfs allow but I was having trouble making it work well, so I figured allowing root on a jail only was an acceptable risk).On the dedicated server, I generated a keypair that allows access to the jail (but not the host). My thinking here is that, if the key were to be compromised, then the only thing an attacker is getting access to is a backup of the server they already apparently have access to, so there's no great increase in risk (assuming they don't have some exploit for breaking out of a jail, but that's an angle that's hard to address, and one that's unlikely to be a problem anyway).
On the dedicated server's root crontab, I have two commands:
0 1 * * * zfs snapshot -r remote@daily_$(date "+\%Y\%m\%d") 0 2 * * * zfs send -RI remote@initial_20231205 remote@daily_$(date "+\%Y\%m\%d")|ssh -p xxxxx root@backupserver zfs receive -Fu home/jails/backups/receive/remoteThe end goal here is a a daily snapshot of my entire remote filesystem being sent to my home server (there is adequate storage space), from which I can either restore my remote server if necessary, or even use it to move jails from the dedicated server to home server if decided to do so. The receiving end, I believe, should match the snapshot structure exactly because of the -F option, meaning if I delete old snapshots on the dedicated server then at the next send they will be deleted on the backup server as well.
The only thing I still intend to do that I haven't done is update the host's firewall to block all network traffic to and from the jail's IP besides over its ssh port, in order to reduce the risk to my home server and network if the jail were to be compromised.
I might also adjust the sshd configuration on the backup jail so that it only runs the
zfs receive command on connection and can't actually be used to gain a shell, but that's not something I've had time to do yet.So far it appears to be working just fine, but am I overlooking any potential problems here?
Last edited:
