Right now I backup my website/server daily using rsync with cron. What I'm worried about is someone hacking into my server and then gaining access to my rsync account and deleting everything. How do I go about protecting myself from this?
As I understand, the main problem is that you've configured the rsync process to be initiated from the "wrong side". Your backup server should be the one initiating the connection and having an account on your production server, not vice versa.
This way you would not need an account on the backup server which is accessible from (and which credentials or access tokens are stored on) the more exposed production server.
Of course, this raises the question of the possible impact of a break into the backup server, but there you can just limit the backup user's ability of breaking things - using an rsync daemon on the production server with a read-only share for the things to back up would be an easy option to do so.
There are a few layers of security that you can build in.
Don't allow access from vulnerable servers to secure servers
The web server should be considered vulnerable, therefore you should limit the possibility of outbound access from your web server to your backup server. The data retrieval should be initiated from the backup server using a read-only, limited account.
Limit the attack surface
You want to have as few services and access points on your web server as possible. One approach is to create a staging point: push data from the web server to a staging server (which should also be considered vulnerable), then pull that data to your backup server to secure it.
|show 1 more comment|
I dont know what hardware you have available but there are several options. The 1st would be to put the data on a tape or some other form of media that can be set aside offline. It may not always get you back the the most recent revision but you would have the data somewhere offline in the case of an attack. The 2nd option would be a secondary "backup" system that keeps a copy of the data. You could remotely rsync the data "down" to that box so if someone did get in, they could not easily get to your backup (keep the passwords, keys, etc. different on both systems and keep up with patches). Both of these assume you can get some more hardware (or even a virtual server in option 2). Anything on the same system would have to be considered suspect if it was compromised.