Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #179180

Re: Guide(s?) to backup philosophies

Path csiph.com!aioe.org!bofh.it!news.nic.it!robomod
From Dan Purgert <dan@djph.net>
Newsgroups linux.debian.user
Subject Re: Guide(s?) to backup philosophies
Date Thu, 23 Mar 2017 10:30:02 +0100
Message-ID <to7ea-eW-25@gated-at.bofh.it> (permalink)
References <tjQYh-4AT-7@gated-at.bofh.it> <tjWr0-8sd-17@gated-at.bofh.it> <tkxJU-Fd-21@gated-at.bofh.it> <tkLMR-2GV-3@gated-at.bofh.it> <tlXCi-535-7@gated-at.bofh.it> <tmeWt-1mc-1@gated-at.bofh.it> <tnM02-11I-27@gated-at.bofh.it> <tnM03-11I-37@gated-at.bofh.it> <tnNp8-2fJ-13@gated-at.bofh.it> <tnNyN-2kr-1@gated-at.bofh.it>
X-Mailbox-Line From debian-user-request@lists.debian.org Thu Mar 23 09:20:19 2017
Old-Return-Path <robomod@news.nic.it>
X-Amavis-Spam-Status No, score=-6.999 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, HEADER_FROM_DIFFERENT_DOMAINS=0.001, LDO_WHITELIST=-5] autolearn=ham autolearn_force=no
X-Policyd-Weight using cached result; rate: -8.1
Organization A noiseless patient Spider
User-Agent slrn/1.0.2 (Linux)
X-Auth-Sender U2FsdGVkX191pQO/tZHdOrl7lAJLFuoeBoqbZflp4qELnV2oMYCVWw==
Cancel-Lock sha1:Yrumi6YDmTH4/rS9emSvCsOBdUk=
Sender robomod@news.nic.it
X-Original-Newsgroups linux.debian.user
X-Original-References <ef34df2b-20d7-e2ed-f9a4-875cc09c9b68@cloud85.net> <1da38dbd-57cc-816a-b108-9b1a54159701@holgerdanske.com> <slrnocd4r9.8pl.dan@xps-linux.djph.net> <b996cffe-6f59-38df-8aa4-35e62a92c150@holgerdanske.com> <slrnocneu7.r9b.dan@xps-linux.djph.net> <9cdbe1f7-6137-ebf7-c844-3873f09bdb3c@holgerdanske.com> <slrnod4l0b.1o1.dan@xps-linux.djph.net> <20170322104533.GB10766@tuxteam.de> <slrnod4pr3.1o1.dan@xps-linux.djph.net> <20170322122012.GA14156@tuxteam.de>
X-Mailing-List <debian-user@lists.debian.org> archive/latest/718792
List-ID <debian-user.lists.debian.org>
List-URL <https://lists.debian.org/debian-user/>
List-Archive https://lists.debian.org/msgid-search/slrnod74lh.1o1.dan@xps-linux.djph.net
Approved robomod@news.nic.it
Lines 60
X-Original-Date Thu, 23 Mar 2017 09:14:47 -0000 (UTC)
X-Original-Message-ID <slrnod74lh.1o1.dan@xps-linux.djph.net>
X-Original-Sender robomod@news.nic.it
Xref csiph.com linux.debian.user:179180

Show key headers only | View raw

<tomas@tuxteam.de> wrote:
>
> On Wed, Mar 22, 2017 at 11:57:44AM -0000, Dan Purgert wrote:
>> <tomas@tuxteam.de> wrote:
>> >
>> > On Wed, Mar 22, 2017 at 10:35:13AM -0000, Dan Purgert wrote:
>> >> David Christensen wrote:
>> >> > On 03/17/2017 03:31 AM, Dan Purgert wrote:
>> >> >> David Christensen wrote:
>> >> >>> On 03/13/2017 05:38 AM, Dan Purgert wrote:
>> >> >>> [...]
>> >> >
>> >> > I should clarify that:
>> >> >
>> >> >      "The backup server can be firewalled with no incoming ports and
>> >> >      outgoing ports limited to SSH and other required ports".
>> >> >
>> >> >
>> >> > I still need to figure out the "other required outgoing ports". 
>> >> > Suggestions and comments are welcome.
>> >> 
>> >> Unfortunately, pretty much "all ephemeral ports", if the server is
>> >> running things that initiate connections.  Some programs allow you to
>> >> specify what ports they're connecting from, but not all.
>> >
>> > That's what ESTABLISHED is for, in firewall jargon (you accept packets
>> > belonging to an established TCP connection).
>> >
>> 
>> You're not gonna have any ESTABLISHED connections in your firewall if
>> you're _initiating_ the connection. ;)
>> 
>> if my firewall has the following rules:
>>  - default drop
>>  - rule 10 accept established
>> 
>> the command:
>> rsync (whatever switches) user@remote-host:/path/to/files/ /local/
>> 
>> Will fail to connect to remote-host, as the rsync command is not
>> connecting across a previously established link. 
>
> You're holding it wrong :)
>
> Remote-host has to allow connections (from wherever, perhaps only
> from the backup host) *to* its port 22. The ESTABLISHED is for
> rsync's "other leg".

You do realize that the thread of discussion you hopped onto was
specifically talking about if the "server box" was _initiating_
connections, right?

Of course if the server is simply responding to incoming requests,
"accept established" would let the responses back out.


-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Guide(s?) to backup philosophies Richard Owlett <rowlett@cloud85.net> - 2017-03-11 16:20 +0100
  Re: Guide(s?) to backup philosophies David Christensen <dpchrist@holgerdanske.com> - 2017-03-11 22:10 +0100
    Re: Guide(s?) to backup philosophies Dan Purgert <dan@djph.net> - 2017-03-13 14:00 +0100
      Re: Guide(s?) to backup philosophies David Christensen <dpchrist@holgerdanske.com> - 2017-03-14 05:00 +0100
        Re: Guide(s?) to backup philosophies Dan Purgert <dan@djph.net> - 2017-03-17 11:50 +0100
          Re: Guide(s?) to backup philosophies Glenn English <ghe2001@gmail.com> - 2017-03-17 19:50 +0100
          Re: Guide(s?) to backup philosophies David Christensen <dpchrist@holgerdanske.com> - 2017-03-18 06:20 +0100
            Re: Guide(s?) to backup philosophies Dan Purgert <dan@djph.net> - 2017-03-22 11:50 +0100
              Re: Guide(s?) to backup philosophies <tomas@tuxteam.de> - 2017-03-22 11:50 +0100
                Re: Guide(s?) to backup philosophies Dan Purgert <dan@djph.net> - 2017-03-22 13:20 +0100
                Re: Guide(s?) to backup philosophies <tomas@tuxteam.de> - 2017-03-22 13:30 +0100
                Re: Guide(s?) to backup philosophies Dan Purgert <dan@djph.net> - 2017-03-23 10:30 +0100
                Re: Guide(s?) to backup philosophies <tomas@tuxteam.de> - 2017-03-23 11:10 +0100
                Re: Guide(s?) to backup philosophies Dan Purgert <dan@djph.net> - 2017-03-23 13:10 +0100
              Re: Guide(s?) to backup philosophies David Christensen <dpchrist@holgerdanske.com> - 2017-03-23 04:00 +0100
                Re: Guide(s?) to backup philosophies Dan Purgert <dan@djph.net> - 2017-03-23 10:40 +0100
                Re: Guide(s?) to backup philosophies David Christensen <dpchrist@holgerdanske.com> - 2017-03-23 20:10 +0100
        Re: should I firewall an open port which isn't used? (was ... Re: Guide(s?) to backup philosophies) Dominik George <nik@naturalnet.de> - 2017-03-31 14:10 +0200
          Re: should I firewall an open port which isn't used? (was ... Re:  Guide(s?) to backup philosophies) Dominik George <nik@naturalnet.de> - 2017-03-31 23:20 +0200
          Re: should I firewall an open port which isn't used? (was ... Re:  Guide(s?) to backup philosophies) Nathan Dorfman <ndorf@rtfm.net> - 2017-04-01 11:00 +0200
        should I firewall an open port which isn't used? (was ... Re:  Guide(s?) to backup philosophies) cbannister@slingshot.co.nz - 2017-03-31 14:10 +0200
          Re: should I firewall an open port which isn't used? (was ... Re:  Guide(s?) to backup philosophies) <tomas@tuxteam.de> - 2017-03-31 14:20 +0200
            Re: should I firewall an open port which isn't used? (was ... Re:  Guide(s?) to backup philosophies) Brian <ad44@cityscape.co.uk> - 2017-03-31 15:20 +0200
              Re: should I firewall an open port which isn't used? (was ... Re:  Guide(s?) to backup philosophies) <tomas@tuxteam.de> - 2017-03-31 15:30 +0200
              Re: should I firewall an open port which isn't used? (was ... Re: Guide(s?) to backup philosophies) Dominik George <nik@naturalnet.de> - 2017-03-31 15:30 +0200
                Re: should I firewall an open port which isn't used? (was ... Re: Guide(s?) to backup philosophies) Dominik George <nik@naturalnet.de> - 2017-03-31 15:50 +0200
      Re: Guide(s?) to backup philosophies Glenn English <ghe2001@gmail.com> - 2017-03-14 19:00 +0100
        Re: Guide(s?) to backup philosophies Dan Ritter <dsr@randomstring.org> - 2017-03-14 19:20 +0100
          Re: Guide(s?) to backup philosophies Miles Fidelman <mfidelman@meetinghouse.net> - 2017-03-14 20:20 +0100
            Re: Guide(s?) to backup philosophies Dan Ritter <dsr@randomstring.org> - 2017-03-14 21:40 +0100
              Re: Guide(s?) to backup philosophies Stefan Monnier <monnier@iro.umontreal.ca> - 2017-03-15 13:30 +0100
                Re: Guide(s?) to backup philosophies Dan Ritter <dsr@randomstring.org> - 2017-03-15 14:10 +0100
                Re: Guide(s?) to backup philosophies "Martin McCormick" <martin.m@suddenlink.net> - 2017-03-15 14:30 +0100
                Re: Guide(s?) to backup philosophies Jonathan Dowland <jmtd@debian.org> - 2017-03-15 16:40 +0100
                Re: Guide(s?) to backup philosophies Jonathan Dowland <jmtd@debian.org> - 2017-03-15 16:40 +0100
                Re: Guide(s?) to backup philosophies Stefan Monnier <monnier@iro.umontreal.ca> - 2017-03-15 21:50 +0100
                Re: Guide(s?) to backup philosophies songbird <songbird@anthive.com> - 2017-03-16 23:50 +0100
        Re: Guide(s?) to backup philosophies Miles Fidelman <mfidelman@meetinghouse.net> - 2017-03-14 20:10 +0100
  Re: Guide(s?) to backup philosophies Joe <joe@jretrading.com> - 2017-03-11 23:30 +0100
    Re: Guide(s?) to backup philosophies Jonathan Dowland <jmtd@debian.org> - 2017-03-15 13:30 +0100
  Re: Guide(s?) to backup philosophies Dan Ritter <dsr@randomstring.org> - 2017-03-13 15:20 +0100
    Re: Guide(s?) to backup philosophies David Christensen <dpchrist@holgerdanske.com> - 2017-03-14 05:10 +0100
    Re: Guide(s?) to backup philosophies Richard Owlett <rowlett@cloud85.net> - 2017-03-14 15:50 +0100
  Re: Guide(s?) to backup philosophies Merlin Büge <toni@bluenox07.de> - 2017-03-14 19:50 +0100
  Re: Guide(s?) to backup philosophies DdB <debianlist@potentially-spam.de-bruyn.de> - 2017-03-19 11:40 +0100

csiph-web