Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using the excellent s3 tools ( to backup files from a Linux based server to S3.

Does anyone know of a good strategy so that I can use this tool to upload o S3 in a way so that if my server was unknowingly and completely compromised, my S3 backups would still not be delete-able?

One requirement is that the backups are non-interactive. My problem is that the .s3cfg file that is saved has the secret access key, which gives an attacker full access to S3.

As far as I can tell, the only way to accomplish this would be if I could upload to S3 authenticated by a write-only (and with no permission to delete) set of credentials, which doesn’t seem to be an option.

Perhaps I am missing something?


share|improve this question

As far as I can tell there's no really secure way to do this short of separating the thing that writes to s3 from the clients that you're backing up (e.g. using something like Bacula, where the storage daemon is separate from the agent on the clients). Note that this just moves the problem (a compromise on the "storage" system leaves you open to the same situation, but presumably you can make that box more secure than you can make your other systems...)

You may also want to look in to Tarsnap as a possibility - I don't know if it solves the security issue for you, but it's a good service: I think Colin pretty neatly solved the "Storing backups on Amazon s3" problem.

share|improve this answer
You may also want to check out duplicity ( It's another good backup client that works with S3 with built-in encryption. It doesn't solve your encryption requirements though - it's only are secure as your GPG private keys on your server. – Tom Purl Mar 15 '11 at 17:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.