Properly Securing Backups for Associations: Encrypted 3-2-1 Strategy with Borg and Restic on Virtualmin

Why associations need to protect their data better

Associations often manage sensitive member data, bank details and internal documents. Data loss or a ransomware attack can paralyze association operations and cause high costs. A well-thought-out backup strategy is therefore essential – not only for companies but also for non-profit organizations.

The 3-2-1 backup rule as a foundation

The 3-2-1 rule states: 3 copies of the data, on 2 different media, with 1 copy off-site. For associations, this means:

• 3 copies: Production data, local backup and an external backup.
• 2 media: e.g. hard drive and cloud storage or two servers.
• 1 offsite copy: Geographically separated to avoid damage from theft, fire or water.

With your own virtual server at dezhost, you can implement this strategy cost-effectively and in a GDPR-compliant way.

Virtualmin as a backup platform

Virtualmin is a powerful open-source server management tool that is perfectly suited for associations. It offers a user-friendly interface for managing domains, email accounts and databases. For backups, you can rely on proven tools such as Borg and Restic, which enable deduplicated, encrypted and incremental backups.

BorgBackup: Deduplication and encryption

Borg is ideal for regular backups of large amounts of data. It compresses and deduplicates data so that only changes are stored. Encryption is done client-side, so even the server operator cannot access the data. Borg is particularly suitable for local backups on a NAS or an external hard drive.

Restic: Cloud-friendly and flexible

Restic is a modern backup tool that supports various backend storage such as SFTP, S3 or Google Cloud Storage. It is also encrypted and deduplicated. Restic is excellent for the offsite copy because it can back up directly to cloud storage without additional software.

Step by step: Setting up encrypted backups with Borg and Restic

1. Prepare the server

Set up a virtual server with Virtualmin. Ensure sufficient storage space and a current Linux distribution. Install Borg and Restic via the package manager:

sudo apt install borgbackup restic

2. Store encryption keys securely

Generate a strong passphrase for Borg and store it in a safe place (e.g. password manager). For Restic, the key is generated automatically; store the output securely. Without the key, the backups are useless.

3. Create backup scripts

Create a shell script that regularly runs Borg backups to a local hard drive and Restic backups to cloud storage. Example for Borg:

#!/bin/bash
borg create --stats --compression zstd,10 /mnt/backup/borg::'{now}' /home /var/www

For Restic:

#!/bin/bash
restic -r sftp:backup-server:/backups backup /home /var/www

Schedule the scripts via cron job, e.g. daily at 2 a.m.

4. Implement offsite backup

For the 3-2-1 rule, you need an offsite copy. Use either a second virtual server at dezhost or cloud storage. Restic can back up directly to S3-compatible storage. Ensure that data transmission is encrypted (e.g. via SFTP or HTTPS).

Ensure GDPR compliance

Associations must comply with the GDPR. Encrypted backups are an important building block because personal data is protected even in the event of a server failure. Ensure that the backup servers are located in the EU and that a data processing agreement (DPA) exists with the host. dezhost provides a DPA upon request.

Further tips on GDPR compliance can be found in our knowledge base.

Ransomware protection through immutability

Ransomware often encrypts backups too if they are reachable. Protect yourself by making backups immutable. Borg and Restic support append-only modes. Set up the backup storage so that after writing, deletion or modification is no longer possible. This keeps your backups intact even during an attack.

Regularly test restoration

A backup is only as good as its restoration. Regularly test restoring individual files or the entire data. Document the restoration process so that in an emergency everyone in the association knows what to do.

Conclusion: More data security with simple means

The combination of Virtualmin, Borg and Restic enables associations to have a professional, encrypted 3-2-1 backup strategy – without high costs. With a web hosting package or a virtual server from dezhost, you lay the foundation for more data security and privacy.