56
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 19 Jun 2026
56 points (95.2% liked)
Selfhosted
60177 readers
534 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
What's the rationale for this? Genuinely curious.
Why downvote this?
The reasoning is that your backup server should be more secure than production. Production has to have a bunch of stuff open in order to be useful and convenient. The backup server does not. It can be basically fully locked down.
To add - by doing pulls the backup server uses different credentials to run than the credentials used to perform pulls.
Backup server has it's own credentials database, machines being backed up have their own database. Backup service in backup server uses appropriate credentials from machine being backed up to access the data there (shares, etc). So credentials from compromised machine are unrelated to credentials for backup server.
And if backups are done properly (full on a schedule, daily incrementals, or something similar) you should be able to revert to a known-good state with minimal data loss.
If the main site gets compromised the credentials there must be considered lost and known to che attackers.
with a pull backup that's not an issue because the main site has no access to the remote system; it is a process on the remote site that has credentials to access the main site and not the other way around.
the remote system may ~~receive~~ retrieve a compromised copy of the data, but the attacker cannot tamper with previous backups so recovery is still possible.
This is the main reason I had in my head about pull backups. Thanks for the explanation.
That makes sense. I use NFS, so there are other controls for security because "offsite" is another building on my property, but still in the same pool of subnets...