Is it even a reasonable idea to have a server at home getting backups of all my clients websites periodically?
Yes, provided you follow some precautions
Is there any security threat to my computers connected on the same network/router as the server that will have FTP access?
Yes, if you do not follow some precautions
- What if my cloud server gets compromised? Then it is likely my home-based backup PC will also be compromised because the cloud server can connect to it.
- What if my home-based backup PC is compromised? What does it have access to?
So you basically want to reduce the risk of compromise of either system, whilst also limiting what access an attacker would have in the event that they do manage to compromise either/both.
- Don't use FTP as credentials can be transmitted unencrypted, run an SSH server on a Linux box, and connect/transfer files using
scp. Alternative - find an SFTP or SCP type server that runs on Linux, Mac or Windows.
- Use a limited SSH account that only has scp access to the backup directory, and only enough access to send the backup.
- Use a private key for authentication
- With the above steps, if your remote cloud server is broken into and the private key is stolen, then an attacker will only get access to a backup of a server that they already have access to!
- Run a firewall which has NAT/port forwarding and DMZ features (could even be your ISP's WiFi router if it has up to date firmware with no known vulnerabilities - double check this - some older ISP routers are riddled with bugs)
- Place your home-based backup computer in a DMZ. This way it doesn't easily get access to any of your other computers, and therefore dramatically reduces the threat if it is compromised. You can forward port 22 from your internal home network to the DMZ and log on with higher privileges for administration/scp purposes.
- Use the NAT/port forwarding to forward a random high TCP port (e.g. 55134) from your public IP to your SSH service - this will make the service less easily picked up
- Restrict access on the firewall so that the forwarded port is only visible to your remote cloud server
- Don't place any confidential data, SSH private keys, passwords, etc. etc. on your backup computer. This way if it is compromised you further reduce what an attacker has access to.
- Keep all systems/services up to date - especially on the cloud server and the backup PC. Vulnerabilities are always being discovered and can often easily be exploited by attackers, for example to turn basic access into root level access. (e.g. https://dirtycow.ninja/)
This list is the ideal scenario and should help you think about the risks. If your ISPs router doesn't have a DMZ feature and you don't want to invest in setting up an alternative firewall, then you might be happy with a compromise (I personally wouldn't be happy with it)- in that case I would ensure host-based firewalls are active on all your internal network PCs, and strong passwords, require authentication for all shares/services etc.
An alternative, as suggested by another user (here is a bit more detail) would be to script your cloud server to produce the backups and make them available, and script your backup PC to connect via SFTP or SCP (SSH) to pull the backups.
This could work well, but lock down the SSH/SFTP port so that only your backup PC can access it, use a limited access account, and think about some of the same precautions. E.g. what if your backup PC is compromised? Then your cloud server is also compromised, etc.