Backups and Disaster Recovery

Why Is This Section Here?

System security is not just about stopping crackers, although that's the popular conception of it. In Practical UNIX and Internet Security, Garfinkel and Spafford define system security not just as keeping intruders out, but as holistic data integrity--the concept that a secure system is one that functions the way you think it ought to, the way you need it to, all the time. That means not just keeping your data safe from prying eyes, but backing it up, protecting it from natural disasters, and so forth. Further, one must accept the tenet that no matter how well-guarded a box, a truly determined cracker will one day find her way in. That means preparing for the inevitable by preparing good forensics tools and careful backups so that the system can be restored with as little downtime and as much useful evidence preserved as possible to help fix the hole for the future.

Some Common Myths about Backups and Disasters

- Backups -

• "It's just my home computer; I don't need backups." Oh yes, you do. Remember that your computer can almost certainly be referred to as 'on a network' at some point, as soon as you dial in or connect up to your ISP. If nothing else, you'll want those backups when your hard-drive heads crash or your apartment floods and takes out your computer.
• "Plan? Who needs a plan? If something breaks, we'll restore it!"Granted, it's usually not expressed quite this blatantly, but this is often how things are run. If your machine is providing services for other people, you need to make some sort of plan for what you'll do about backups. Some things to consider:
  • Will you back up user data, or only system files? With what priorities?
  • If a user needs data restored from a backup, what kind of turnaround are you willing to offer?
  • If the system goes down, is the service it provides critical enough to mandate having a warm backup or a fallback server waiting? How long will you need to implement that failover and what steps will you need to take to do it?
  • If the box is critical to a larger number of users, do you need to schedule maintenance to it carefully to avoid interruptions of service during peak hours?
• "You have to use complicated backup software and special media for that." Granted, there's some really expensive, complicated, powerful backup software out there, and some really high-priced, specially-designed backup media. You could buy all of that if you really feel you need it, but backups can just as easily be done using tar and a floppy disk (although you'd need a lot of floppies to backup an 18GB drive!) Most shell programming books will include a simple backup script, and if they don't, check out what's available in "The UNIX Administrator's Handbook" (AKA 'The Red Book') and its CD. [NOTE: for the rest of this document, I'll refer to the object that you store your backups on as a 'tape', because that's the most common backup device I've seen.]
• "I still can't back up my system: I have a 1GB Jaz drive for a 20GB filesystem!" Aah, Grasshopper, you must learn the discipline of the incremental backup! UNIX defines 10 backup levels, starting from 0 and going to 9. Level 0 is a complete dump of the filesystem in question, top to bottom, and then each successive level above that is a backup of any file that has changed since the last lower- or same- level backup. Thus, a level 2 backup gets only those files which have changed since the last level 0, level 1, or level 2 backup, and leaves those files which have not changed alone.
• "Our backup software says it backed the drive up just fine. Why would I need to take the time to test that?" To put it politely, your backup software may be lying like a cheap rug, or it may not be aware of errors beyond its control. One common problem is that if the backup software completes a run, it may not report errors that occurred during the run to anything but the machine's console. Possibly the most common and the worst problem with backups, though, is media errors: the tape is simply bad, and appears to be recording data while recording only garbage. Test, test, test: every so often (say, once a week or so) pick a random file from a random backup and restore it, so as to check that everything you need will be there when you need it.
• "It's OK--we can run without backups if need be." Maybe, maybe for a short while, but not for long, and not without risks. Murphy's Law is especially unforgiving in situations like this, and while you may be OK nine times out of ten, will you really be OK if this is time number ten?
• "I keep all my backup media right next to the server so that I can keep track of it." If you value your backups at all, don't do this. My fiancee had her laptop stolen, which was somewhat traumatic until she realized that she'd been doing backups. It then became really tragic when she realized the backups had been in the bag that was taken with her laptop in it. Take a tape at random from your backups (or regularly, like the backup you make every Monday) and store it someplace else--another room, another building, a safe deposit box at the bank, whatever. If you have a friend with a similar quandary, arrange to trade tapes--he keeps your offsite backups and you keep his, so you always know there's someone else with a copy if you need it. That having been said, make sure you trust the person you give your tapes to! A bank deposit box is pretty safe, but use a little judicious paranoia when exchanging tapes with a person--you're handing them your data in a readable format (unless you use encrypted backups, which is possible), so for heaven's sakes don't hand your favorite SimCity projects to a competitor!

- Power Failures -

• "UPS? Don't they do packages?" Well, yes, but a UPS is also an "Uninterruptible Power Supply": an electrical device that you plug into the wall and then plug your computer into. Like a surge protector, it protects against surges, spikes and so forth in the power supply, but it also should have a battery inside, that will keep your computer going for anywhere from 5 minutes to an hour, depending on the model of UPS and the number of things plugged into it. For $250 or so, you can get one with a serial port on the back that can connect to your computer--various daemons are available for Linux that will talk to your UPS--if the power fails in your building, your UPS sends a signal across that serial cable to your computer, and the power daemon listening knows that it needs to shut down the computer soon to prevent data corruption. The less expensive models assume that you'll be in the room if the power fails or don't care if your computer dies abruptly should the failure last longer than your battery, and will just sound an alarm when they switch to battery power.
• "I keep all of my equipment plugged into my UPS." While you can do this, there's a definite problem with doing it: unlike your average CPU unit (the actual "box" of your computer), most monitors suck power like they were made by Hoover. Further, in the event of a power failure during which you need your monitor, it won't care if it gets suddenly cut off, then plugged into your UPS to continue work. I would strongly recommend buying a good surge protector, and using that for all but your CPU and perhaps any expensive peripherals that you'd really need (like, say, that external SCSI drive...) in the event of a power failure. The fewer items you have plugged into your UPS, the longer the power surge it will be able to pull you through.

-

• "
  -| Previous: Resources Page |