How to prevent deletion of backups?

[progval]

I have two servers, A and B. I want to use Borg to make encrypted backups of A on host B (key stored on A, so data is safe if B is compromised).
However, I would like to prevent A from deleting its backups on B, so an attacker with control of A cannot remove backups from before A was compromised.

Is this possible with Borg? If yes, how?

[ThomasWaldmann]

Borg's encryption deals with the case of a untrusted backup repo server, so the symm. encryption key is stored on the machine running the borg client.

You can do different things server-side to avoid deletion: filesystem and lvm snapshots come to mind.

Also, recent borg versions can operate in "append-only" mode, making archive or repo deletion impossible.

Some people experiment with pull backups (using ssh -R) which is good if the client is compromised, but bad if server is compromised.

[progval]

The append-only mode looks nice, sorry I missed it when reading the doc.
Is it possible to make borg serve run append-only, and have borg prune work at the same time (ie. without editing the config file)?

[enkore]

Not at this time

[ThomasWaldmann]

Allowing to change the append-mode from the client would miss the point of protecting against "owned" clients deleting the repo or archives. borg prune must run on the client as it needs the encryption key.

[progval]

I can have an other client, safer than A, allowed to prune.

[ThomasWaldmann]

I am adding some words about this to docs / FAQ.

There is currently no automation to toggle append-only mode.

[ThomasWaldmann]

See also #36, #900.

[ThomasWaldmann]

See PR #1012.

[Peitemoukiemena]

The append-only mode looks nice, sorry I missed it when reading the doc.
Is it possible to make borg serve run append-only, and have borg prune work at the same time (ie. without editing the config file)?

So in order to prevent server A from running borg prune to the repo on server B, you need to run on server B:

borg serve --append-only ..." ssh-rsa <of server A>"

Is that correct?

[Peitemoukiemena]

well, in the authorized_keys file, adding in front of the ssh key command="borg server --append-only" ssh-rsa........ doesn't work. It's still lets you prune from server A the repo on server B.

[ThomasWaldmann]

Typo: it's serve not server.

[Peitemoukiemena]

I just noticed that. But in the file I wrote it correctly and it's not working.
So is my syntax wrong? Is it

command="borg serve --append-only" ssh-rsa........

or

command="borg serve --append-only" /path/to/repo ssh-rsa........

I tried these two and none works.

[ThomasWaldmann]

How do you determine "not working"?

Please note that append-only is not holding the client back from running borg prune.
From the client perspective it will run normally and logically delete archives (== the archives are not visible any more in borg list).
But on the server, it will only append that to the state that was there before, so it can be rolled back (see the docs about append-only).