proxmox-mirrors/proxmox-backup
1
0
Fork 1
mirror of https://git.proxmox.com/git/proxmox-backup synced 2025-05-01 04:05:57 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

docs: ransom ware: reflow text to our 80cc

Browse Source 
and drop some trailing whitespace while at it

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Thomas Lamprecht 2022-11-28 10:25:23 +01:00
parent b8e78fae91
commit d2641fbbd8
1 changed files with 38 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

69
docs/storage.rst
View File

@ -385,55 +385,60 @@ Prevention by Proxmox Backup Server
`Ransomware <https://en.wikipedia.org/wiki/Ransomware>`_ is a type of malware `Ransomware <https://en.wikipedia.org/wiki/Ransomware>`_ is a type of malware
that encrypts files until a ransom is paid. Proxmox Backup Server includes that encrypts files until a ransom is paid. Proxmox Backup Server includes
features to mitigate ransomware attacks by offering easy restoration from backups. features to mitigate ransomware attacks by offering easy restoration from
backups.
As a best practice, you should keep multiple backups, including outside of your As a best practice, you should keep multiple backups, including outside of your
network and on different media. Proxmox Backup Server provides the tools to do network and on different media. Proxmox Backup Server provides the tools to do
both. It is possible to create :ref:`remote sync jobs <backup_remote>`; by both.
setting up a remote Proxmox Backup Server you can take advantage of the sync job It is possible to create :ref:`remote sync jobs <backup_remote>`; by
feature and create off-site copies of your backups. This is recommended, since setting up a remote Proxmox Backup Server you can take advantage of the sync
offsite instances are less likely to be infected by the ransomware in your local job feature and create off-site copies of your backups.
network. It is also possible to create :ref:`tape backups <tape_backup>` as a This is recommended, since offsite instances are less likely to be infected by
second storage medium. This way you get an additional copy of your data which the ransomware in your local network. It is also possible to create :ref:`tape
can easily be moved off-site. backups <tape_backup>` as a second storage medium.
This way you get an additional copy of your data which can easily be moved
off-site.
Proxmox Backup Server does not rewrite data for existing blocks. This means that Proxmox Backup Server does not rewrite data for existing blocks. This means
a compromised Proxmox VE host, or any other compromised system using that a compromised Proxmox VE host, or any other compromised system using the
the client to back up data, cannot corrupt existing backups. client to back up data, cannot corrupt existing backups.
Furthermore, comprehensive :ref:`user management <user_mgmt>` is offered by Furthermore, comprehensive :ref:`user management <user_mgmt>` is offered by
Proxmox Backup Server. By limiting a sync user's or an access token's right to Proxmox Backup Server.
only write backups, not delete them, compromised clients cannot delete By limiting a sync user's or an access token's right to only write backups, not
existing backups. Following this best practice, backup pruning should be done delete them, compromised clients cannot delete existing backups.
by the Proxmox Backup Server using prune jobs. Following this best practice, backup pruning should be done by the Proxmox
Backup Server using prune jobs.
While your Proxmox Backup Server can still be compromised, if your backup is While your Proxmox Backup Server can still be compromised, if your backup is
encrypted by ransomware, the SHA-256 checksums of the backups will not match encrypted by ransomware, the SHA-256 checksums of the backups will not match
the previously recorded ones anymore. Hence, restoring the backup will fail. the previously recorded ones anymore. Hence, restoring the backup will fail.
To detect ransomware inside a compromised guest, it is recommended to frequently To detect ransomware inside a compromised guest, it is recommended to
test restoring and booting backups. Make sure to restore to a new guest and frequently test restoring and booting backups. Make sure to restore to a new
not to overwrite your current guest. In the case of many backed-up guests, it is guest and not to overwrite your current guest.
recommended to automate this restore testing or, if this is not possible, to In the case of many backed-up guests, it is recommended to automate this
restore random samples from the backups. restore testing or, if this is not possible, to restore random samples from the
backups.
In order to be able to react quickly in case of a ransomware attack, it
is recommended to regularly test restoring from your backups. Make sure to
restore to a new guest and not to overwrite your current guest. Restoring
many guests at once can be cumbersome, which is why it is advisable to
automate this task and verify that your automated process works. If this is not
feasible, it is recommended to restore random samples from your backups. While
creating backups is is important, verifying that the backups work is equally
important. This ensures that you are able to react quickly in case of an emergency
and keeps disruption of your services to a minimum.
In order to be able to react quickly in case of a ransomware attack, it is
recommended to regularly test restoring from your backups. Make sure to restore
to a new guest and not to overwrite your current guest.
Restoring many guests at once can be cumbersome, which is why it is advisable
to automate this task and verify that your automated process works. If this is
not feasible, it is recommended to restore random samples from your backups.
While creating backups is is important, verifying that the backups work is
equally important. This ensures that you are able to react quickly in case of
an emergency and keeps disruption of your services to a minimum.
Other Prevention Methods and Best Practices Other Prevention Methods and Best Practices
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
It is recommended to take additional security measures, apart from the ones offered It is recommended to take additional security measures, apart from the ones
by Proxmox Backup Server. These recommendations include, but are not limited to: offered by Proxmox Backup Server. These recommendations include, but are not
limited to:
* Keeping the firmware and software up-to-date to patch exploits and * Keeping the firmware and software up-to-date to patch exploits and
vulnerabilities (such as vulnerabilities (such as