Ransomware‑Resilient Backups on Linux with Restic and Backblaze B2 Object Lock

on

Overview

If you need cloud backups that ransomware cannot silently erase, combine Restic with Backblaze B2 buckets that have Object Lock enabled. Restic gives fast, deduplicated encrypted backups, while B2 Object Lock makes every uploaded backup file immutable for a time you choose. This guide shows how to set up the entire pipeline on Linux, from creating an Object Lock bucket to scheduling backups and verifying restores.

What You Need

- A Linux machine with shell access (Ubuntu/Debian/RHEL/AlmaLinux etc.)

- A Backblaze B2 account

- Restic 0.12 or newer (most modern distros provide it)

- Basic understanding of environment variables and systemd (for scheduling)

Step 1 — Create a Backblaze B2 Bucket with Object Lock

1) Sign in to the Backblaze B2 web console and create a new bucket. Choose a unique name, keep it Private, and enable Object Lock during creation. You cannot turn this on later for an existing bucket.

2) In the bucket settings, set a Default Bucket Retention under Object Lock. A common starting point is Governance mode with a retention of 30 days. This applies immutability automatically to all new objects (Restic pack files), blocking deletion or modification until retention expires.

3) Optional: configure lifecycle rules for versioning if you store non-Restic data in the same bucket. For a pure Restic repository, the default retention plus Restic’s own forget/prune policy is usually enough.

Step 2 — Generate a Restricted Application Key

Create a new application key limited to your bucket. In Backblaze, go to App Keys, click Add a New Application Key, restrict it to the bucket you created, and copy the KeyID and Application Key. Treat these like passwords.

Step 3 — Install Restic

On Ubuntu/Debian, run: sudo apt update && sudo apt install restic. On RHEL/AlmaLinux/Rocky, use: sudo dnf install restic. If your distro is outdated, download the latest static binary from Restic’s releases page and place it in /usr/local/bin with executable permissions.

Step 4 — Export Environment Variables

Set environment variables so Restic knows how to reach B2 and encrypt your repository:

export RESTIC_REPOSITORY=b2:your-bucket-name:restic-repo

export B2_ACCOUNT_ID=your-key-id

export B2_ACCOUNT_KEY=your-application-key

export RESTIC_PASSWORD=strong-passphrase (or use RESTIC_PASSWORD_FILE to read it from a file)

Tip: store these in a root-only file such as /root/.restic-env, then source it: set -a; . /root/.restic-env; set +a.

Step 5 — Initialize the Repository

Create the Restic repository in your B2 bucket: restic init. You should see “created restic repository.” From now on, all data is encrypted client-side and written as immutable objects (because the bucket has Object Lock with default retention).

Step 6 — Run Your First Backup

Start with a focused scope. For example: restic backup /etc /home /var/www --exclude "*/node_modules/*" --tag initial. Restic deduplicates files automatically and shows a summary when done. Use tags like --tag server01 to identify hosts or workloads.

Step 7 — Set a Retention Policy (Forget + Prune)

Tell Restic how many restore points to keep. A common policy is: restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune. Note: pruning cannot remove pack files that are still under Object Lock. That is expected. Deletion will occur automatically once retention expires and the data is no longer referenced by any snapshot.

Step 8 — Schedule Automatic Backups with systemd

Create a service file, e.g. /etc/systemd/system/restic-backup.service with:

[Unit]
Description=Restic backup
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
EnvironmentFile=/root/.restic-env
ExecStart=/usr/bin/restic backup /etc /home /var/www --exclude "*/node_modules/*" --tag daily
ExecStart=/usr/bin/restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

Add a timer in /etc/systemd/system/restic-backup.timer:

[Unit]
Description=Run Restic backup daily

[Timer]
OnCalendar=daily
Persistent=true

[Install]
WantedBy=timers.target

Enable with: sudo systemctl daemon-reload && sudo systemctl enable --now restic-backup.timer.

Step 9 — Test a Restore

List snapshots: restic snapshots. Restore the latest to a safe directory: restic restore latest --target /tmp/restore. To restore a single path, add --include "/etc" or --include "/home/user/Documents". Verify that the restored files open normally.

Security and Cost Tips

- Use RESTIC_PASSWORD_FILE with a root-only file and consider storing it via a secrets manager or an encrypted password store.

- Restrict your B2 application key to the single bucket and avoid account-wide keys.

- Monitor storage growth. Deduplication helps, but backups expand over time. Object Lock increases short-term storage because data cannot be deleted until retention ends.

Troubleshooting

- Permission errors (403): verify the KeyID/key, bucket restriction, and that Object Lock is enabled.

- Time sync issues: B2 rejects requests if the server time is off. Ensure NTP is running (systemd-timesyncd or chrony).

- Prune failures: if objects are still under retention, pruning cannot delete them. This is normal. They will be removed automatically once retention expires and no snapshots reference them.

You’re Done

You now have a backup strategy that is fast, encrypted, deduplicated, and resilient to ransomware. Restic handles the heavy lifting, while Backblaze B2 Object Lock prevents attackers or accidents from wiping out recent restore points. Periodically test restores and review your retention window to balance recoverability and storage costs.

3.
Read more
Post a Comment
Subscribe to: Posts (Atom)

Popular Posts

Install Ollama and Open WebUI on Ubuntu 24.04 with NVIDIA GPU Acceleration (Step-by-Step)

Overview Running a local large language model (LLM) is easier than ever thanks to Ollama and Open WebUI. Ollama handles model downloads and inference, while Open WebUI gives you a clean, chat-style interface in your browser. In this tutorial, you'll install both on Ubuntu 24.04 (works on 22.04 too), enable NVIDIA GPU acceleration, and deploy them with Docker Compose. The result is a fast, private AI stack you control. What You'll Need - Ubuntu 24.04 or 22.04 (fresh or existing server/desktop). - An NVIDIA GPU with recent drivers (Turing/RTX or newer recommended). - Root or sudo access. - Open ports 3000 (Open WebUI) and 11434 (Ollama) on your firewall if you access remotely. Step 1: Install NVIDIA Drivers and Verify CUDA First, update your system and install the recommended NVIDIA driver. On Ubuntu Desktop you can use Additional Drivers, but the CLI route is reliable: sudo apt update && sudo apt -y upgrade sudo ubuntu-drivers autoinstall sudo reboot After reboo...

Install a Local AI Chatbot on Ubuntu 24.04 with Ollama and Open WebUI (Step-by-Step)

Running a fast, private AI chatbot on your own computer or server is easier than ever. In this guide, you will install Ollama (a lightweight local LLM runtime) and Open WebUI (a modern web interface) on Ubuntu 24.04 . You will be able to chat with models like Llama 3 or Mistral without sending data to the cloud, and with optional GPU acceleration if you have an NVIDIA card. What you will need : an Ubuntu 22.04/24.04 machine (VM, bare metal, or WSL), at least 8 GB RAM (16 GB recommended for larger models), 15–30 GB free disk space for models, Internet access, and optional NVIDIA GPU drivers for acceleration. Why Ollama + Open WebUI? Ollama manages local large language models (LLMs) with simple commands and sensible defaults. Open WebUI gives you a clean, chat-style interface with features like prompt history, file uploads (for some models), and model switching. Together, they are a simple, reliable stack for a self-hosted AI experience. 1) Update Ubuntu and install basics First, ...

Install Ollama + Open WebUI on Ubuntu 24.04 with NVIDIA GPU Acceleration (Step-by-Step)

Overview This guide shows you how to install Ollama and Open WebUI on Ubuntu 24.04 with NVIDIA GPU acceleration. You will get a fast local AI stack that can run modern large language models (LLMs) like Llama 3 on your own hardware, secured and accessible in a web browser. We will cover GPU driver setup, Docker with the NVIDIA Container Toolkit, Ollama installation, Open WebUI deployment, basic security, and troubleshooting. Prerequisites - A machine running Ubuntu 24.04 (fresh or updated). - An NVIDIA GPU with at least 8 GB VRAM recommended for 8B models (more is better). - Internet access and sudo privileges. Step 1: Install the NVIDIA GPU Driver Install the recommended proprietary driver so CUDA becomes available to both Ollama and containers. sudo apt update && sudo apt install -y ubuntu-drivers-common sudo ubuntu-drivers autoinstall sudo reboot After reboot, verify the GPU is recognized: nvidia-smi You should see a driver version and your GPU model. If not, check...

Trending Now

Homogeneous Nucleation on Mars: A Textbook Process Finally Observed in Nature

on
By the end of this piece, you will understand what the Arsia Mons Elongated Cloud is, why it resisted explanation for several years after its first observation, and what the newly published model reveals about a physical process that has never been directly confirmed on any planet's atmosphere. The cloud that broke the model Every morning during Martian spring and summer, a thin, extremely long cloud forms near the Arsia Mons volcano and gradually elongates until it stretches to more than 1,000 miles before dissipating. The cycle then repeats for several months. The formation was first recorded by a probe in 2018, and from that point onward it became a persistent puzzle for atmospheric scientists working with Mars data. The cloud's geometry, its timing, and its seasonal recurrence all pointed to a real and reproducible physical process, yet no existing model could reproduce it. For a technical audience familiar with simulation work, the situation is analogous to a product...