0

I am using the excellent s3 tools (http://s3tools.org/s3cmd) to backup files from a Linux based server to S3.

Does anyone know of a good strategy so that I can use this tool to upload o S3 in a way so that if my server was unknowingly and completely compromised, my S3 backups would still not be delete-able?

One requirement is that the backups are non-interactive. My problem is that the .s3cfg file that is saved has the secret access key, which gives an attacker full access to S3.

As far as I can tell, the only way to accomplish this would be if I could upload to S3 authenticated by a write-only (and with no permission to delete) set of credentials, which doesn’t seem to be an option.

Perhaps I am missing something?

Thanks.

1 Answer 1

1

As far as I can tell there's no really secure way to do this short of separating the thing that writes to s3 from the clients that you're backing up (e.g. using something like Bacula, where the storage daemon is separate from the agent on the clients). Note that this just moves the problem (a compromise on the "storage" system leaves you open to the same situation, but presumably you can make that box more secure than you can make your other systems...)

You may also want to look in to Tarsnap as a possibility - I don't know if it solves the security issue for you, but it's a good service: I think Colin pretty neatly solved the "Storing backups on Amazon s3" problem.

1
  • 1
    You may also want to check out duplicity (duplicity.nongnu.org). It's another good backup client that works with S3 with built-in encryption. It doesn't solve your encryption requirements though - it's only are secure as your GPG private keys on your server.
    – Tom Purl
    Mar 15, 2011 at 17:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .