Lesson 7.2: Backups you can actually restore
A backup is only real once you've restored it. Good backups follow the 3-2-1 rule (three copies, two different media, one off-site), are checked with checksums, are tested by restoring, and at least one copy is out of reach of an attacker who gets root on the server, because ransomware deletes backups first. In the lab you archive web02's web content and uploads, record and verify a checksum, copy everything to a separate backup disk, prove a restore gives identical files, and leave the backup disk read-only.
16 min
You will learn to
- Explain the 3-2-1 rule and offline copies
- Create a compressed archive with tar
- Record and verify checksums
- Copy backups with rsync
- Test a restore with diff -r
Key terms
- 3-2-1 rule
- Three copies of data, on two different media, one off-site.
- Checksum
- A hash of the archive used to detect corruption or tampering.
- Restore test
- Restoring a backup to a scratch location and comparing it with the source.
- Immutable backup
- A copy that can't be changed or deleted for a set time, even by an administrator.
- RPO / RTO
- How much data you can afford to lose / how long recovery may take.
← Linux package management · All lessons · Capstone: triaging a compromised server →