This is the main reason I had in my head about pull backups. Thanks for the explanation.
Comment on How do you protect a remote backup from a compromised account?
pgo_lemmy@feddit.it 2 days agoIf the main site gets compromised the credentials there must be considered lost and known to che attackers.
with a pull backup that’s not an issue because the main site has no access to the remote system; it is a process on the remote site that has credentials to access the main site and not the other way around.
the remote system may receive a compromised copy of the data, but the attacker cannot tamper with previous backups so recovery is still possible.
lIlIllIlIIIllIlIlII@lemmy.zip 1 day ago
non_burglar@lemmy.world 1 day ago
That makes sense. I use NFS, so there are other controls for security because “offsite” is another building on my property, but still in the same pool of subnets…