2024-02-12 - Error on "Open Image"

When clicking "Open Image" on an image on a network drive when accessed from Macrium Site Manager, an error is shown.

Solution: make sure "System" is given read privileges both in the advanced security properties for the folder as well as the network share security properties!!!

Alternatively, change what user the macrium services run as, and give that user permissions to the folder.

Backup aborted! - Unable to read from disk - Error Code 23 - (CRC)

This error usually occurs if sectors are going bad on the hard drive.

As a first step, create a backup of the drive if possible, or at least create a copy of all user files! The following commands, even the simple "chkdsk", can send the health of a drive spiraling down so that in a matter of minutes you go from a system that's mostly OK to having lost the drive completely!

Macrium's recommendation in such cases is to replace the hard drive a.s.a.p. The best approach to do so is to boot into a Macrium Rescue Disk, and set Macrium to ignore read errors (see below), and clone the disk from there. This also eliminates any possible issues with VSS.

Alternatively, you can try to first fix the issues with the drive first using chkdsk or dism. But this may not be a good idea as the repair process itself could lead to even more issues with the disk. You could also first create a clone with the "Ignore bad sectors" option turned on, then try to repair the disk issues, and clone again. If you run into issues during the repair you always have a clone you can fall back on.

Temporary Fix

The following commands can temporarily fix the problem (until further sectors start getting corrupted):

chkdsk C: /r /f (Change drive letter if applicable; /f is implied by /r 
but doesn't hurt)
dism /Online /Cleanup-Image /CheckHealth
dism /Online /Cleanup-Image /ScanHealth
sfc /scannow
dism /Online /Cleanup-Image /RestoreHealth

If possible, run the above after booting into a Macrium Rescue Disk. Doing so and cloning the disk from there also eliminates the possibility that the issue is with VSS. Also, the issues may be on a drive without a drive letter, in this case assign a drive letter to it first before running chkdsk.

Imaging with Bad Sectors

It is possible (though not recommended by Macrium) to instruct Macrium to ignore bad sectors:

In some versions of Macrium, there is no such option but you can choose to turn off the "Verify the File System" option in the advanced settings, and if that doesn't work, choose to create a "Forensic Copy".

Tools to check disk health:

• Hard Disk Sentinel
• Crystal Diskinfo (for a simple S.M.A.R.T. check)
• Samsung’s Magician

Sources:

• Imaging disks with bad sectors
• Error Code 23 - Data error (cyclic redundancy check)
• What causes a CRC error?
• Macrium Reflect CRC error code 23
  

Issues with VSS

Technical abstract of what helped in my situation:

Check for any errors:
vssadmin list writers
vssadmin list shadowstorage
vssadmin list shadows
vssadmin list providers

SFC /SCANNOW
chkdsk c: /f

Re-register VSS components:

cd /d %windir%\system32
net stop vss
net stop swprv
regsvr32 /s ole32.dll
regsvr32 /s oleaut32.dll
regsvr32 /s vss_ps.dll
vssvc /register
regsvr32 /s /i swprv.dll
regsvr32 /s /i eventcls.dll
regsvr32 /s es.dll
regsvr32 /s stdprov.dll
regsvr32 /s vssui.dll
regsvr32 /s msxml.dll
regsvr32 /s msxml3.dll
regsvr32 /s msxml4.dll
vssvc /register
net start swprv
net start vss

Run Tweaking.com repair

hard shutdown (admin command prompt shutdown /s) followed by cold start power

restart each one individually.
COM+ Event System
COM+ System Application
Microsoft Software Shadow Copy Provider
Volume Shadow Copy

Reference #1: https://www.tenforums.com/backup-restore/75366-cannot-backup-macrium-reflect-free-2.html

"I bet your system disk is to full which means that there is not enough free space for VSS to do its work. You could delete some older restore points and see if that helps. Better consider upgrading to a larger disk is space is low. Do a surface test with Crystal Diskinfo and Macrorit Disk scanner just to eliminate the most basic possibility.

Reference #2: https://knowledgebase.macrium.com/display/KNOW/VSS+fails+due+to+modification+by+3rd+party+software

"Uninstall ShadowProtect
Remove the registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Providers{24602736-bed9-4619-91b0-243447c6409c}.
Restart Windows.
If you don't have the registry key above then check you only have the following entry for VSS software providers in your registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Providers

Copy this text to Windows notepad:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Providers{b5946137-7b9f-4925-af80-51abd60b20d5}]
@="Microsoft Software Shadow Copy provider 1.0"
"Type"=dword:00000001
"Version"="1.0.0.7"
"VersionId"="{00000001-0000-0000-0007-000000000001}"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS\Providers{b5946137-7b9f-4925-af80-51abd60b20d5}\CLSID]
@="{65EE1DBA-8FF4-4a58-AC1C-3470EE2F376A}
Save as VSSWriters.reg.
Double click VSSWriters.reg in Windows Explorer to import the entries in your system registry.

If you have not been able to fix your issue using the solution above download and run one of the below programs to fix your problem.
http://updates.macrium.com/reflect/utilities/vssfixx64.exe

Reference #3: https://www.ibm.com/support/pages/vssebadstate-message-during-system-state-backup

To verify if it fails when handling the raw volume, the Microsoft VSS tracing tool vsstrace.exe can be used. This tool retrieves more detailed information about all related modules. The tool is included in a Windows Software Development Kit (SDK). If the tool is installed, it is located in this directory:
C:\Program Files (x86)\Windows Kits\8.0\bin\x64.

If it does not exist, download the Windows Software Development Kit (SDK):
https://developer.microsoft.com/en-us/windows/downloads/windows-8-sdk

Reference #4: https://www.ibm.com/support/pages/node/258653

During troubleshooting of problems with SystemState backup or Open File Support/Online Image using VSS, it is sometimes useful to test the VSS portion by itself.

You can start diskshadow and logging all outputs to a file by starting a Command Prompt and launching this command:
diskshadow /l c:\diskshadow.out

From the diskshadow prompt, issue the following commands:

reset
list writers
list writers status
list writers metadata
list writers detailed
list providers
exit

The output of all the above commands will be found in c:\diskshadow.out.

Test a snapshot of SystemState

When dealing with SystemState backup failures, sometimes the problem is with Tivoli Storage Manager, sometimes on Windows either with VSS itself or with one of its writers. Testing outside Tivoli Storage Manager helps determine if the problem is within Tivoli Storage Manager or some other area.

You can start diskshadow and logging all outputs to a file by starting a Command Prompt and launching this command:
diskshadow /l c:\diskshadowsys.out

From the diskshadow prompt, issue the following commands:

reset
set verbose on
set option differential
set context volatile
add volume c:
add volume d: (if the system is on more than one disk, add them one by one)
create
exit

The output of all the above commands will be found in c:\diskshadowsys.out. Review this file for errors. Any failure during the create phase indicate a problem either with VSS or one of the writers which should be pursued with Microsoft.

The Dreaded Macrium Reflect 0x8004231f Error

See this post on tipsdotcom.com!

Inaccessible Boot Device!

This is often straightforward to fix because Macrium provides a "Redeploy to New Hardware" function in the Macrium Rescue Environment. This feature is well documented in the Macrium Knowledgebase, see: Re-deploying Windows to new hardware using Macrium ReDeploy. Macrium may ask for some missing drivers, which in my case was "Intel RST VMD Controller." You can find these on Intel's website (look for the zipped, VMD version with filename "F6flpy-x64 - VMD.zip"). Download it and unzip the archive to a directory on the Macrium Rescue Environment thumb drive, Macrium will then automatically find the missing drivers during the redeploy process. Alternatively, try to disable RST from within UEFI.

Additionally, Macrium also has a feature called "Fix Windows Boot Problems" which is also well documented in the Macrium knowledgebase: Fixing Windows boot problems

This feature basically helps fix issues such as invalid Boot Configuration Data. The BCD usually needs to be corrected after cloning a GPT formatted drive because the drive ID and configuation will have changed, and Windows will not be able to boot until the BCD is updated.

For some background on the BCD, please read: Working with BCD in Windows 10

Understanding the modern Windows boot process
Use of boot configuration data, or BCD, and the Windows bootloader was introduced with Windows Vista. Windows OS load behavior was substantially reworked in 2004, when Vista was still code-named “Longhorn” to support EFI and to overhaul the earlier NTLDR (“NT Loader”) architecture used in preceding versions of Windows NT.

In fact, BCD is best understood as a firmware-independent database for boot-time configuration data. The BCD information resides in a data file named bootmgfw.efi in the EFI partition in the EFIMicrosoftBoot folder. You will also find a copy of this file in the Windows Side-by-Side (WinSxS) directory hierarchy. When a PC begins booting, a firmware-based bootstrap loader starts the boot process and then hands the process over to the Windows Boot Loader (you’ll see this latter program referenced as a line item in your BIOS or UEFI boot information, usually as the default OS boot entry). That boot loader accesses the EFI partition on the default or designated boot drive, and uses the BCD information to start booting the OS so it can take over control of the PC.

There are two major variations on the Windows boot theme. Some (mostly older) PCs use a Master Boot Record (MBR) disk layout and work with BIOS to perform what’s now called a “legacy boot.” Other (mostly newer) PCs use a GUID Partition Table (GPT) disk layout and work with UEFI to perform what’s called a “UEFI boot” or “EFI boot.” Some of the details involved in managing boot vary according to the type of boot (legacy vs. EFI) that’s performed, so it’s important to know what you’re working with on any given PC…

After running both the "Fix Windows Boot Problems" and the "Redeploy to New Hardware" functions on the new computer from within the Macrium Rescue Environment, windows started to boot! And then promptly showed a BSOD with the error "iastorafs.sys"

iastorafs.sys BSOD

You may get an "SYSTEM_THREAD_EXCEPTION_NOT_HANDLED" or "DRIVER_IRQL_NOT_LESS_OR_EQUAL" mentioning iastorafs.sys, and no amount of restarts or windows repair sessions will help. You can google and you'll find plenty of useless articles on the topic such as this one: Top 3 Ways to Fix iaStorA.sys BSOD Windows 10 where they explain how to resolve the issue…from within Windows.

Luckily Erik over at tipsdotcom.com stumbled upon an easy fix, which he describes in detail in his post "Macrium Reflect iastorafs.sys BSOD Error". I suggest you read it, but in short, you simply have to boot into the Macrium Rescue Environment and use either the command line of the Windows Explorer utility (little icon on the bottom-left) to find "iastorafs.sys" and rename it to anything else. In my case it was located here: c:\windows\system32\drivers\iastorafs.sys

Finishing Up, igfxdin.dll bug

The steps above were enough to get me into Windows. Of course, next steps are to use windows upate to install all updates as well as missing drivers that Windows can find for itself. I also downloaded drivers and software manually from Acer's website, since Windows isn't able to find everything using Windows Update. And then, as icing on the cake, after a final reboot windows went into a forever loop where after logging in, the explorer process kept crashing, so basically the taskbar kept disappearing and reappearing. Even booting into safe mode or with low-resolution drivers didn't help. Luckily the task manager still worked and from there I was able to open the windows event viewer (just run eventvwr), and in the application logs I saw the same error being logged over and over mentioning igfxdin.dll. Because this is associated with the "Intel Common User Interface" I first thought it must be one of the Intel drivers I just installed. It took me a while to realize that the real cuplrit was OpenShell, which I had installed on the old laptop. Perhaps it was trying to show some message and this was leading igfxdin.dll to crash, which took the explorer process with it - I'm not enough of an expert to understand the process - but in the end I was able to run appwiz.cpl and uninstall Open Shell. This fixed the issue. Of course, I tried to reinstall it just to check, and the problem came back, so for now the user will be stuck with the terrible Windows 10 start menu. Oh well.

I used to be with a great hosting company, Lunarpages. 19 years of hardly any issues! Unfortunately they've been acquired by "HostPapa", an Endurance International Group brand. EIG is a notorious conglomerate that gobbles up smaller IPP-s one after the other and then uses dodgy tactics to extort money from their clients (check this link for a list of companies they own). You can read many reports on the net about how your site suddenly becomes "hacked" and you have to pay $$ for your IPP to "clean" the site before you are once again allowed access to your own files. Now I haven't personally experienced this, however after my site was migrated I had serious issues with email and the site itself. Ping would result in 20-30% packet loss, sometimes 100% for hours. My email was inaccessible. After three days of trying to sort it out with their chat support, I started looking around. Good thing I did, because a few months after they hit me with the first rate hike which could be "avoided" by paying 2 years up-front. Which I did...unfortunately. A few months after they sent a letter that one of my mailboxes exceeded its limits and now I'd have to pay $2/mailbox/month extra. Of course I emailed them that my account never before had such a limit, and it's not OK to charge your customer for 2 years of service and then to start to impose arbitrary limits that did not exist before - they didn't care, and refused to even partially refund the 2 years of service they channeled me into paying up-front just a few months before. I've published our emails in this post, so you can judge for yourself whether their tactics are something you'd like to put up with or not.

So this all finally convinced me to look around for a new, non-EIG host. For a list of EIG-owned brands to avoid, check out Full List of EIG Hosting Brands (+ Non-EIG Hosting Recommendation):

And here are my emails on the matter with HostPapa, decide for yourself:

On 9/13/2021 3:11 PM, galin.bozhkov@hostpapa.com wrote:

Hello Laszlo,

My  name is Galin Bozhkov from the HostPapa’s Solutions Team.  I’m  contacting you concerning the email storage of your web hosting plan. As  you know, LunarPages was acquired by HostPapa a year ago. All hosting  accounts originally purchased with LunarPages have been migrated to our  HostPapa servers. It now shares the same resources as all of our other  shared plans.

As  a hosting company, it is our main priority to provide a stable and  secure server environment and make sure that the hosting accounts  provided by us are not used for data archiving. To help you with the  transition, we have provided you with a higher storage limit than our  most basic shared hosting plans for the past year. However, because  storing large volumes of email on your account has a negative effect on  your account and the server, it is not feasible for us to continue  providing unlimited storage for your email accounts.

That  being said, our system administrators notified me that one or more of  your email accounts has exceeded that limit allocated to your plan by  using 1GB or more per account. You can learn more about the limits we  have for our shared hosting plans here:
https://hostpapasupport.com/email-account-limits-restrictions-quotas/

Please  reply to this email with the best way to reach you (email/phone), so we  can find a way to resolve this quickly and find a more suitable  solution for your needs.

I look forward to hearing from you!
Kind Regards,
Galin Bozhkov
Account Manager
HostPapa Inc.

On 9/16/2021 4:45 PM, galin.bozhkov@hostpapa.com wrote:

Hello Laszlo,

It’s Galin Bozhkov again, from the Solutions department at HostPapa. I’ve recently sent you a message regarding your email storage limits for your ex-Lunarpages plan.

Today, I’m reaching out to you again to remind you that your email storage has exceeded its limits.

There are a few quick steps you can take as a way to resolve this:
- Delete older emails, especially ones with large file attachments
- Empty your trash
- Upgrade to an email solution that will allow you to store more emails.

Reducing the size of the inbox will offer you some time, but it’s not a permanent solution, so I encourage you to reach out to me as soon as possible to discuss the different solutions we can offer to accommodate your email needs. If we don’t hear from you, the account may automatically be limited or suspended.  As your Account Manager, it is my duty to ensure your project is running smoothly, therefore I would happily help you avoid any type of suspension or interruption from your service, that is why it is essential for you to reply back.

Please reply to this email and let me know what's the best way to reach you.
I’m here to help, so don’t hesitate to reply back!

Kind Regards...

Sun, 19 Sep 2021 23:15, Laszlo Lieszkovszky wrote:

Hi Galin,

We have received your emails but will need some time to sort this out. Thank you for your patience - we have, after all, been clients of yours for over twenty years.

Regards,
Laszlo

On 9/20/2021 10:08 AM, galin.bozhkov@hostpapa.com wrote:

Dear Laszlo,

Thank you for your response, can you please let me know how much time you would need as I need to inform our administrators.

Our  System Admin has detected that 1 of your users are above the allowed  limit. The allowed individual (per mail account) mailbox storage size  for your hosting package is 1 GB.

You are able to review the storage used for your email accounts in your cPanel -> Email Accounts.

You  see your mailboxes space as unlimited in cPanel because if it is  otherwise your emails will be automatically suspended once you reach the  limits for your package. To avoid mail service disruption and missed  emails that the setting is left as unlimited.

You  have the option to clean up and delete some emails from the mentioned  mailboxes, but have in mind that they are quite large and doing this may  require many emails to be deleted.

On  the other hand, if you want to fix this issue quickly and without any  complications, I would recommend simply upgrading to a VPS / email  license.

Please review this and let me know how you would like me to help you.
I remain at your disposal and I will await your response.

Kind Regards...

Tue, 21 Sep 2021 19:17, Laszlo Lieszkovszky wrote:

Dear Galin,

We have been a client of Lunarpages since 2001. Since acquiring Lunarpages, HostPapa has increased the monthly price to $10.95 / month, and now you wish to charge us extra for any email that uses over 1 GB of storage space - even though our account is supposedly unlimited, and never was any such limit imposed on us over the past 20 years. You are trying to squeeze your customers for a few extra cents.

We have decided to move away from Lunarpages. We request that you cancel all services provided to us and close our account a.s.a.p.

You billed us on May 5th, 2021 for 2 years of service. You *could have* notified us of the planned price hike then, but did not do so. Hitting us with this extra charge now, after we've settled the bill for 2 years of service, is disingenuous and really a form of extortion and we find this unacceptable.

You billed us $263.76 for 2 years of service on May 5th, for service period May/20/2021 -May/20/2023. As we are requesting the cancellation now, so we've used 4 months (plus one day) of this 24 month period. If you are a reputable company, you will refund us for the remaining 19 months. That would be $208.81.

We've also initiated the cancellation of our service through your account control panel.

Regards,
     Laszlo Lieszkovszky

On 9/21/2021 7:02 PM, galin.bozhkov@hostpapa.com wrote:

Dear Laszlo,

Thank you very much for getting back to me.

If you don't mind me asking, why have you decided to cancel your hosting service?
Kind Regards...

Tue, 21 Sep 2021 20:40, Laszlo Lieszkovszky wrote:

That question is clearly answered in the previous email that I sent you. If you intended to further increase your rates or to impose arbitrary limits you should have notified us before billing us for two years of service.

Regards,
     Laszlo Lieszkovszky

On 9/22/2021 10:37 AM, galin.bozhkov@hostpapa.com wrote:

Dear Laszlo,

Thank you very much for getting back to me.

I'm afraid that as each currency loses value over time (due to inflation), so do the prices of different goods and services increase. Regarding your second question, you have always  had this limit.

As this is a shared hosting server, you are benefiting from the lowest price possible by sharing the resources of the server with other users. When we exceed our allocated resources, this naturally leaves less resources for the other users on the server and might cause unwanted issues.

Having said that, I certainly understand your situation and I want this to work for you. If you believe there is a chance you could stay with us, I could speak with our billing department and see if we are able to provide you with a discount on one of the plans, which would be better suited for your storage usage.

Kind Regards...

Wed, 22 Sep 2021 12:23, Laszlo Lieszkovszky wrote:

Dear Galin,
   Increasing the price of hosting for the upcoming billing period is of course understandable. The user has time to prepare and switch hosts if he wishes. But charging for hosting and afterwards imposing some arbitrary extra limits like       "max 1 GB per email account" and then trying to charge for it is not OK. Heck, you could write us in half a year and say "we've had to impose a limit of max 10 outgoing emails per day due to some users using our services to send spam emails, so if you wish to send more than that, please consider upgrading to our premium   email plan for $5/mailbox/month." These are extortionary tactics.      
   
   What does this have to do with inflation? It's like if you buy a car and pay it all and then when you want to drive it off of the lot the salesman says "oh sorry,       you'll have to pay $2k for us to open the gates, you know, inflation and limited resources."
   
   Regarding "you've always had this limit" it's possible that HostPapa has had plans with such limits, but we signed up for Lunarpages around 20 years ago, not whatever plan HostPapa is offering now. Lunarpages then upgraded us to their new "unlimited" plan around October, 2008 (I'm attaching our correspondence).  Here's a screenshot of Lunarpages' "Unlimited" hosting offer from 2008. Do you see any mention of a 1GB per-mailbox limit?

Source: https://web.archive.org/web/20081022175506/http://www.lunarpages.com/basic-hosting/
   
   Even in 2016 they made no mention of a per-mailbox limit: https://web.archive.org/web/20161202104120/https://lunarpages.com/web-hosting/shared-hosting

Not even in their acceptable use policy: https://web.archive.org/web/20161108035739/https://lunarpages.com/legal/acceptable-use-policy/

Regarding "leaving less resources for other users", so you are saying that us having one email account that took up less than 4 GB of resources was actually causing       resource issues on your server.
   
In any case, we're leaving. The only question is whether you will refund us for the remaining 19 months of service. Of course you are not obliged to do so :-)
   
   Regards,
     Laszlo Lieszkovszky

On 9/24/2021 7:33 PM, galin.bozhkov@hostpapa.com wrote:

Dear Laszlo,

Thank you for getting back to me.

As  you are on a shared hosting server, you cannot use an unlimited number  of resources. In the screenshot provided before you are correct in  stating that you can have an unlimited number of email accounts, however  LP has always had this limit on the total storage.

Having said  that, if you believe there is a chance you could stay with us, I would  be happy to help you further examine the situation and make it work for  you.

Have a great weekend!

Kind Regards...

On 10/7/2021 12:25 AM, Laszlo Lieszkovszky wrote:

Dear Galin,

I'd like to escalate this ticket to a manager please. We are requesting that you close our account, and that you refund us for the remaining 19 months of service that we paid for. We've explained in depth why we came to this decision.

Quoting from my previous email:

You billed us $263.76 for 2 years of service on May 5th, for service period May/20/2021 -May/20/2023. As we are requesting the cancellation now, so we've used 4 months (plus one day) of this 24 month period. If you are a reputable company, you will refund us for the remaining 19 months. That would be $208.81.

Regards,
     Laszlo Lieszkovszky

A simple question begets a simple answer but alas it is not so. Here's how you can add a user as an admin to a Google Workspace account without paying for an extra (and unused) account. There's also a similar question on stackexchange.

(1) Transfer your subscription from Google Domains to Google Workspace

This is only necessary if you originally signed up for GSuite through Google Domains. Don't ask me why the two parts of Google act as if they were separate companies. The instructions from Google are clear enough:

1. Sign in to Google Domains.
2. Select the name of the domain you’d like to transfer.
3. Open the menu.
4. Click Email.
5. Click Manage Google Workspace subscription.
6. Scroll down to "Transfer subscription" and click Transfer. Confirm the transfer in the dialog box.

After you transfer your account, you won’t see your Google  Workspace users listed in your Google Domains settings, but their Google  Workspace services continue as usual. If you need to manage users, sign in to the Google Workspace Admin console.
Also, when you transfer, billing  in Google Domains stops immediately. You have 30 days to set up billing  in Google Workspace or your service is suspended.

The transfer should be immediate. You will then be shown a warning:

Follow the instructions on the linked help page:

Only the primary super administrator who created the account can set up billing.

1. In your Google Admin console (at admin.google.com)...
2. Go to Billing > Subscriptions.
3. At the top, click Start Paid Service or Set Up Billing.
4. Follow the onscreen instructions to set up billing.

Basically, you need to log into your Google Workspace account and go to Billing → Subscriptions. You should see a banner at the top of the page asking you to add billing info (if you haven't already), and once that's done, there'll be another banner asking you to activate billing. Once this is done you should be able to...

(2) Add Google Identity Free subscription

This step is necessary so that you can add an account to your Google Workspace without assigning that account a paid subscription. You can read more about it here as well as here.

Log into your Google Workspace account and go to Billing → Subscriptions → Add or Update Subscription.

If you see an error (like "contact your reseller" then you may need to go through step #1 above, or read this google help page).

Choose "Cloud Identity" from the categories and select "Cloud Identity Free." Next - next - OK and eventually you should see it in your list of subscriptions:

Once done, you should see a useful warning:

(3) Turn off automatic Google Workspace licensing during setup

Google has a useful help page on this topic here.

Basically, in your Google Workspace admin console, go to Licensing → License settigns, and make sure "Automatic licensing" is off:

(4) Add the new admin account & grant privileges

You can finally go to your Google Workspace admin console, navigate to Directory → Users, and click "Add new user". Fill in the user's details. Once the user is created click on the name and look for the "ASSIGN ROLES" link in the "Admin roles and privileges" box:

...and assign whatever roles you want. The "Super Admin" role is usually what you want to assign your IT MSP.

Google also has a helpful article on how to Make user an admin.

(5) Secure the new admin account

You (being the IT MSP) should then log in as the new admin and set up 2FA etc. This is done in your regular Google Account control panel:

Permanently Map a Network Drive on Mac

From: https://osxdaily.com/2010/09/20/map-a-network-drive-on-a-mac/

1. From the Mac OS X Finder, hit Command+K to bring up the ‘Connect to Server’ window
2. Enter the path to the network drive you want to map, ie: smb://networkcomputer/networkshare and click ‘Connect’
3. Enter your login/password, select “Remember this password in my keychain”, and click “OK” to mount the network drive. *Some shares will not work with the keychain though.
4. Select the newly added folder, then choose File  Add To Sidebar.

The drive is now mounted, but continue on to map for system reboot persistence

1. Now enter into System Preferences, from the Apple menu
2. Click on ‘Accounts’
3. Click on “Login Items”
4. Just drag the share from your desktop or Finder window into the Login Items list.
   OR
   Click on the + button to add another login item
   Locate the network drive you previously mounted and click “Add”
5. To solve the issue of a Finder window showing the network drive each time you log in, you can check the Hide box in the Login Items list.

The downside, which I've not yet been able to resolve, is that it will open a Finder window for that share every time you log on. I have a few shares configured this way for our Windows Home Server (Music, Videos, Photos, etc)... and every time I log in, I get multiple Finder windows - one for each share. The Hide checkbox appears to affect Applications opened at login, but doesn't seem to change whether or not the Finder window is opened for a mapped volume
https://superuser.com/questions/130787/permanently-map-a-network-drive-on-mac-os-x-leopard

Another option:
You may want to look at macmounter, an open source, python project that automatically mounts drives, and keeps them mounted: https://github.com/roubles/macmounter

How to Make the Mapped Network Drive Visible on the Mac Desktop

It’s possible that the mounted drive will not appear on the desktop due to a system setting. If you want the mapped drive icon to be visible on the Desktop, be sure to do the following additional steps:
From the Finder, open Finder Preferences by hitting Command+,
Click the General tab
Select the checkbox next to ‘Connected Servers’
Close Finder Preferences
Selecting the checkbox next to Connected Servers ensures that you’ll see the icon on your Mac Desktop, otherwise it will only be visible in the Finder window sidebars and Open/Save dialogues.
https://osxdaily.com/2010/09/20/map-a-network-drive-on-a-mac/

Remount a mapped network drive with a click in OS X

A great additional step for either method is to create an alias of the mapped network drive. This allows you to reconnect to the share with just a click. Here’s how to do this:
Right-click on the mapped network drive on the Mac OS desktop
Select “Make Alias”
Now you can double-click that alias to reconnect to the network drive instantly.
https://osxdaily.com/2010/09/20/map-a-network-drive-on-a-mac/

How to sync dashboards across users?

Unfortunately I haven't found a way to do so either through the backend or through any plugin. But it's simple enough through the database! Dashboard configs are stored in the backend_user_preferences table in the value field of rows where item="dashboard". Simply find the value you want to copy and paste it to any other users with whom you want to share your dashboard. Of course this is a manual procedure but it's easy enough to do.

One gotcha might have to do with permissions, so for example if you've placed some widgets on your dashboard that the other user doesn't have permissions for, this might cause an issue. So to test, in the backend users management panel, open up the user and click the "Impersonate" button. You will now see the backend as they would see it.

Updated on: 2023-08-10 - Szelence

Applicable for: Windows 11 Professional

Basics - you should know this if you're here :-)

• To open the "run dialog" to run a program, type WIN + r
• To run anything with administrative privileges, open the run dialog and hit CTRL + SHIFT + ENTER
• To run something in an elevated command prompt, combine the previous two steps:  WIN + r, type "cmd", and press SHIFT + ENTER
• To open Powershell, just run "Powershell"
• To open user management, run lusrmgr.msc
• Get to the classic Network Connections panel: run ncpa.cpl
• Find out your windows version: run winver
• Open the task scheduler: run taskschd.msc
• Open registry editor: run regedit
• To open Computer Management app, run: compmgmt.msc
• To open System Properties classic control panel applet: sysdm.cpl

Some Tools

• Sysinternals: technical tools like diskmon, sysmon, autoruns etc.
• Microsoft Power Toys

Windows "Tweakers" that are mostly GUI-s for the registry:

• Winaero Tweaker: made in Russia but my favorite 👍 👍
• Chris Titus's "Windows 11 Perfect Install" post and utililty: also see his video on the topic 👍
• SophiApp: open-source tweaker with GUI 👍
• Ultimate Windows Tweaker 👍 but be careful, for example Action Center will no longer show if you click and apply the setting "Disable Windows Ink Workspace"
• O&O ShutUp10++ 👍
• ThisIsWin11 Debloater and tweaker, succeeded by the BloatyNosyApp, not a big fan

Paid tools for customizing the start menu etc.:

• StartAllBack 👍
• Stardock Start11
• ExplorerPatcher

Older tools:

• BlackBird to disable Windows telemetry, "spying" (Windows 10)

Steps

(-1) Install all updates

Before getting started get windows up to date with all patches etc. since newer patches might undo some of the changes that we will implement.

(0) Tweak Some System Settings

a) Enable System Protection

Control Panel → System → System Protection tab, make sure that system protection is on for any drives that aren't used exclusively for backup.

b) Disable remote assistance

Since you are more likely to win the lottery than to receive remote assistance from Microsoft, it's best to turn this off.

Control Panel → System → Remote dialog

c) Rename the computer

Control Panel → System

(1) Install Basic Utilities

which we will use further on:

• Notepad++
• 7Zip
• OpenShell
• Remote Access Software
• Office Suite
• Antivirus
• Browser (Chrome, Firefox, and/or Brave)
• Video and audio players (AIMP, MusicBee, VLC)
• FSCapture, FSViewer
• X-Mouse Button Control, AutoHotKey, PureText, Everything, DisplayFusion, SyncTrayzor, AutoRun Organizer, Listary, VistaSwitcher
• Corporate chat, task management, knowledgebase

(1) Reign in Windows Update

Used to be in Settings → Updates & Security → Advanced Options, now there isn't much that can be configured in Windows 11 without editing the registry/a tweak app.

Optional: Use Sordum to Disable Further Automatic Updates

You could try to manually disable the windows update service, but a more surefire way is to use Sordum. Search for the most recent version of their Windows Update Blocker.

Of course, re-enable windows update every once in a while!

(2) Run Sophia to Optimize

Download current version from the link at the top. Used to be command-line only, now it has  GUI, my changes were:

#DisableSigninInfo
#DisableLanguageListAccess
#DisableWindowsWelcomeExperience
#EnableWindowsTips
DisableWindowsTips
#HideTaskViewButton
#ShowSecondsInSystemClock
#ShowTrayIcons
#WindowsColorSchemeDark
#AppModeDark
#DisableNewAppInstalledNotification
#HideFirstSigninAnimation
#UninstallOneDrive

About Storage Sense:

Storage Sense is the Disk Cleanup replacement for the modern world. It frees up space on your computer by deleting things like recycle bin contents, temporary internet files, and app temporary files. This also includes the Downloads folder, but you can change that if you don’t want Storage Sense emptying it.

#EnableStorageSenseRecycleBin
DisableStorageSenseRecycleBin
#DisableHibernate
EnableHibernate
#SetTempPath
#EnableWin32LongPaths
#DisableDeliveryOptimization
DisableUpdatesMicrosoftProducts
#EnableUpdatesMicrosoftProducts
#DesktopPowerManagementScheme
#ChangeUserShellFolderLocation
#AutomaticRecommendedTroubleshooting
#DisableAutoplay
#EnableSmartActiveHours
DisableSmartActiveHours
#SetAppGraphicsPerformance
#DisableAppsSmartScreen
#HideSendToContext
#DisablePreviousVersionsPage

(3) Privacy

Settings → Privacy & go through each page (Speech, Inking, etc.) & turn off as required

(4) Disable File Content Indexing

Windows Explorer → C: drive → Properties

Use Everything instead of Windows' own indexing feature!

(5) Enable F8 at Startup

This is no longer possible with windows 11 as it was with Windows 10 (see Rick Daily Tips or read this article). The simplest way to get into safe mode with Win11 is by holding down SHIFT while clicking on Restart from the start menu, or by running shutdown /r /o from an elevated command prompt, or from Settings → System → Advanced Startup.

You can also choose to always display a boot menu, set the timeout, or disable it using the GUI at: System Properties (sysdm.cpl) → Advanced → Startup and Recovery, or with the following commands:

bcdedit /set {bootmgr} displaybootmenu yes
bcdedit /set {bootmgr} timeout 5
bcdedit /set {bootmgr} displaybootmenu no

(6) Conclusively stop wake timers from waking Windows 10 desktop

You can check what last woke your computer from an elevated command prompt with: powercfg /LASTWAKE

Find a list of scheduled services that may wake your computer: powercfg /WAKETIMERS

Check your BIOS for any possible settings, such was disabling wake-on-lan.

→ then, follow this superuser thread as well as this article; I will also paraphrase in short:

(6.1) Disable Wake Timers for All Power Profiles

(6.2) Revoke "Wake" Privileges from Scheduled Tasks

1. Download PSTools
2. Open an elevated command prompt, and from your PSTools directory run psexec.exe -i -s %windir%\system32\mmc.exe /s taskschd.msc (this opens up task scheduler with system permissions)
3. Go to Task Scheduler Library → Microsoft → Windows → UpdateOrchestrator
4. Go through each task there and ensure that "Wake the computer to run this task" is not checked
5. You can also disable each task that was set to wake the computer (for example: Reboot, Reboot_AC, or Backup Scan, UpdateAssistantWakeupRun
6. Find each task in the following folder in file explorer: C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator, make yourself the owner, and remove "Modify" and "Full Control" permissions from every user that has is, also disable inheritance
7. Find any more scheduled tasks that are set to wake the computer: in an elevated powershell, run Get-ScheduledTask | where {$_.settings.waketorun}
8. Remove the "Wake Computer" permission from each task that was found

(6.3) Disable Hardware from Waking Up Your PC

In an elevated command prompt, run: powercfg -devicequery wake_armed

For each device found, go to device manager and adjust settings (usually in the Power Managemen tab).

(6.4) Group Policy

In group policy editor, disable: Computer Configuration → Administrative Templates → Windows Components → Windows Update → Enabling Windows Update Power Management to automatically wake up the system to install scheduled updates.

(6.5) Automatic Maintenance

Control Panel → Security and Maintenance → Maintenance → Change Maintenance Settings, and set to a normal time of day:

(6.6) Set Computer to Shut Down Fully

In regedit:

1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
2. Find or create: PowerdownAfterShutdown  (DWORD (32-bit))
3. Set to 1 (Decimal)

Credits, sources & further reading (which isn't linked to in the text above):

• Setting up the perfect Windows 10 Installation | Faster, Lighter, and Functional
• Debloat Windows 10 in 2020
• 17 Reasons Why I Do Not Use Windows 10
• How do I stop Windows 10 from waking itself up from Sleep Mode?
• How to Fix the Computer Keeps Waking up from Sleep Problem?

(7) Enable Num Lock at Startup

This can be done with a program like WinAero Tweaker, or manually as follows.

First, head to HKEY_CURRENT_USER\Control Panel\Keyboard. Double-click the “InitialKeyboardIndicators” value in the right pane and set it to “2”.
Next, expand the “HKEY_USERS” folder. You’ll now need to repeat the above process several times, changing the InitialKeyboardIndicators value under each folder inside the HKEY_USERS folder.
Start by going to HKEY_USERS\.DEFAULT\Control Panel\Keyboard, and changing the InitialKeyboardIndicators value to 2 [note: the default value is 2147483648]. Next, repeat the process for the folder below the .DEFAULT folder–it’ll start with an “S-“.
Repeat this process for the remaining folders inside HKEY_USERS, changing the Control Panel\Keyboard\InitialKeyboardIndicators setting under each one.
Once you’re done, you should just be able to reboot and Windows 10 should automatically enable Num Lock at boot. However, it doesn’t actually work this way. The Fast Startup feature, also known as Hybrid Boot, overrides this setting and Windows will continue to boot with Num Lock off.
We’ve found two ways to prevent this from happening. You could disable fast startup, but we’ve found a better trick that should work for you without losing the advantages of hybrid boot.
After you run the .reg file, shut down your computer. Don’t reboot it–select the “Shut down” option.
Boot the computer back up again. When you reach the login screen, press the Num Lock key once to enable it. Don’t log into the computer. From the login screen, click the power button and select “Shut down” to shut down the computer again.
Boot the computer back up and Num Lock will be enabled on the login screen. It seems that this puts Fast Startup into a state where it will automatically enable Num Lock at every boot. Yes, this is a weird trick–but it works. (Thanks to DznyRulz on Reddit for discovering this!)
You could also prevent this from happening by disabling the Fast Startup feature after making the above tweaks to your registry. If the trick above doesn’t work for you, try disabling Fast Startup instead.
To do so, open the Control Panel, click “Hardware and Sound,” click “Power Options,” and click “Choose what the power buttons do.” Click the “Change settings that are currently unavailable link at the top of this screen, and then scroll down and uncheck the “Turn on fast startup (recommended)” option. Click “Save changes.”

From: https://www.howtogeek.com/244606/how-to-enable-num-lock-automatically-when-your-computer-boots/

(8) Various Other Optimizations

8.1 Disable Background Apps

Used to be at Settings → Privacy → Background apps, but with Windows 11 this has to be done manually for each app, which is a pain, so it's easiest to use Winaero Tweaker or SophiApp.

8.2 Disable “Get tips, tricks, and suggestions as you use Windows”

Settings → System → Notifications & Actions → Get tips, tricks...

8.3 Disable Runtime Broker Service

https://www.tenforums.com/network-sharing/7907-runtime-broker-process-6.html#post660867

What fixed my Runtime Broker problem was:
Start "Photos" app
Select "Settings" (bottom left corner)
In the Sources section remove any network URLs.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TimeBroker, change Start from 3 to 4
4 is Disabled, 3 is Manual and 2 is Automatic startup.
https://www.tenforums.com/performance-maintenance/12707-stop-runtime-broker-running-constantly-background-3.html
https://wethegeek.com/how-to-fix-runtime-broker-high-cpu-usage-in-windows-10/

The Drill for Me When Runtime Broker Decides to Hog My CPU
After a Windows 10 update-reboot:
kill Runtime Broker
In settings>privacy>background apps turn off Groove Music and, if you have a lot of pictures, turn off Photos too.
In Services, stop and then restart the Time Broker service (Run/Open services.msc). This re-launches up Runtime Broker task which now behaves per the settings you just fixed in #2 above.
https://www.tenforums.com/performance-maintenance/12707-stop-runtime-broker-running-constantly-background-2.html?s=f5b0d945e5e785538f3a3f9e3154b311

(9) Other Utilities

- I have not tested all of these, use carefully!

9.1 Windows 10 Debloater (free) - ❤️

Excellent little open-source utility.

9.2 MacPaw CleanMyPC - 👍👍

Pretty good but expensive, subscription-based utility!

9.3 AVG Tune-Up - 👍

Has some useful features but also subscribtion-ware, and doesn't have any utility to uninstall built-in windows apps.

9.4 IOBit Uninstaller - 👍👎

Download IObit Uninstaller 11 Free - 100% Free Uninstall Programs & Plugins

Uninstall Unwanted and Won’t-be-uninstalled Programs & Annoying toolbars and plug-ins Promptly & Thoroughly

IObit IObit

It does make uninstalling built-in windows apps easy, but it's quite slow, and the installer includes a bunch of bundleware (VPN, PC-tuner, etc). Purchase page has a fake "people viewing today" and "purchases today" counter, and the price seems to be an annual subscription. Not impressed.

• Aegis for Windows 7/8.x - Block all known Microsoft spying and Windows 10 upgrade elements
• Debloat-Windows-10
• How to Remove Windows 10 Bloatware / Built in Apps and Restore Them Again
• SpiceWorks: How to: Remove Built-in Apps and Default Apps Windows 10 Apps

1. I use Linode's own backup service
2. Duplicati to back up specific directories & mysqldump of my databases to Backblaze B2

For an overview of my backup strategy, as well as alternative software and solutions, see my post "Backing up a Headless Ubuntu Web Server (to Cloud & QNAP NAS)".

Install Duplicati on Ubuntu 20.04

This is well documented on Duplicati's docs (with some slight mistakes), which may well be more up-to-date than this blog post, so I suggest you follow that. Here's what I did:

(1) Install Mono & required packages

sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 3FA7E0328081BFF6A14DA29AA6A19B38D3D831EF

# For 18.04:
echo "deb https://download.mono-project.com/repo/ubuntu stable-bionic main" | sudo tee /etc/apt/sources.list.d/mono-official-stable.list
# For 20.04:
echo "deb https://download.mono-project.com/repo/ubuntu stable-focal main" | sudo tee /etc/apt/sources.list.d/mono-official-stable.list

sudo apt update

sudo apt install mono-devel gtk-sharp2
# or alternatively do: sudo apt install mono-complete 

sudo apt install apt-transport-https sudo nano git-core python software-properties-common dirmngr

Download Debian .deb file from https://www.duplicati.com/download https://github.com/duplicati/duplicati/releases:

wget https://github.com/duplicati/duplicati/releases/download/v2.0.5.111-2.0.5.111_canary_2020-09-26/duplicati_2.0.5.111-1_all.deb
apt install ./duplicati_2.0.5.111-1_all.deb     

Replace the directory and filename with current versions!

Create the service:

sudo vi /etc/systemd/system/duplicati.service 

Paste the following:

[Unit]
Description=Duplicati web-server
After=network.target

[Service]
Nice=19
IOSchedulingClass=idle
EnvironmentFile=-/etc/default/duplicati
ExecStart=/usr/bin/duplicati-server $DAEMON_OPTS
Restart=always

[Install]
WantedBy=multi-user.target

Also set daemon options:

sudo vi /etc/default/duplicati

Set it to:

# Defaults for duplicati initscript
# sourced by /etc/init.d/duplicati
# installed at /etc/default/duplicati by the maintainer scripts

#
# This is a POSIX shell fragment
#

# Additional options that are passed to the Daemon.
DAEMON_OPTS="--webservice-interface=any --webservice-port=8200 --portable-mode"

Enable and start the service:

sudo systemctl enable duplicati.service
sudo systemctl daemon-reload
sudo systemctl start duplicati.service  
sudo systemctl status duplicati.service

Enable remote access to your Duplicati UI through Putty

Duplicati runs a web server listening on port 8200. If you use Putty to connect to your server, you can set Putty up to create a tunnel when you connect to your node. This is quite secure as only you will be able to access the Duplicati UI when you've logged into your node.

Click "Add"!

And save your Putty profile.

Now,  you should be able to access your Duplicati instance once you've logged into your server with Putty:

(if it asks you for a password, go ahead and set one up).

Note: 0pen http://127.0.0.1:8200, NOT http://127.0.0.1:8200/login.html!

If you can't access Duplicati's web interface, try to re-connect with Putty. Apparently Putty only creates the tunnel if a service is already listening on the remote end at the time that the connection is made.

Allow Duplicati through your Firewall

A more convenient solution is to allow Duplicati through your firewall. Do this only if you're on a fixed IP address - you don't want to expose Duplicato to everyone.

If you use UFW like I do this is simple enough:

sudo ufw allow from 111.222.333.0/24 to any port 8200 proto tcp

If you have a fix IP address you can specify that, or a subnet as I did. See How To Set Up a Firewall with UFW on Ubuntu 14.04 for help on setting up and using UFW.

Sign up to Backblaze

You can use any other cloud provider that Duplicati supports, I chose Backblaze because it's cheap with straightforward pricing, fast, and easy to use.

Once signed up:

1. Create a "bucket" for your backups
2. Create a new "App Key" (note the app ID and key, you will need them later)

Sign up to Healthchecks.io

After signing up, create a new check. Make note of the email ping address that you can use to let healthchecks know that your backup succeeded ("How to Ping"):

You can also click Filtering Rules... and add the following:

Configure Email Notifiations with Duplicati

Go to Settings → Default Options, click Edit as list and enter:

--send-mail-from=Duplicati <sender@address.com>
--send-mail-to=recipient@mailbox.com
--send-mail-level=all
--send-mail-body=%RESULT%
--send-mail-password=SMTP_PASSWORD
--send-mail-subject=%PARSEDRESULT%: Duplicati %OPERATIONNAME% report for %backup-name%
--send-mail-url=mail.your-mail-server.com
--send-mail-username=sender@address.com

of course, replace example strings above as necessary. You can click Edit as list to go back to list view, which includes hints on how to configure the above variables.

If using ufw, allow outgoing mail (adjust ports as needed):

sudo ufw allow out 587

If you get erros like "Failed to send message: MailKit.Security.SslHandhsakeException: An error occurred while attempting to establish an SSL or TLS connection" then a solution is to add the following option to the backup settings (or the general settings):

--accept-any-ssl-certificate=true

Back up WWW

You can back up whatever you want, but I started with WWW. Click Add backup, and then:

• Your "Bucket name" must be the name of one of your buckets set up in Backblaze
• The "Folder path" can be anything you want, such as "my-linode-backup"
• The B2 App ID and Key you get when you create a new "App Key" in Backblaze

Configure your schedule as you wish in step 4

In step 5, add "send-mail-to" advanced option, and set the "send-mail-to" to the "ping address" for your healthchecks.io check.

Verify!

Now, if you manually run your backup:

You should see that your healthchecks.io check was "pinged". You should set your healthchecks.io check period to match the backup schedule you set for your Duplicati job.

Back up MySQL

You can use various methods to back up your MySQL, you could even try to just shut down your database and make a backup of  your MySQL data dir. But from my research it seems that the best path is to use mysqldump to create a backup of your database in the local filesystem, and back up that folder.

First, create a dedicated MySQL user and give it PROCESS privileges. Then, create a script in your user profile, dump_mysql.sh:

#!/bin/bash
mysqldump --defaults-extra-file=<(printf "[client]\nuser = %s\npassword = %s" "root" "YOUR_PASSWORD") --all-databases 1> /home/YOUR_LOGIN/backup/mysql/mysql.sql 2> "$(date +/home/YOUR_LOGIN/backup/log/dump_mysql_%Y-%m-%d_%H-%M-%S.log)"
exit 0

A drawback is that you are storing your mysql pw in clear text in the script. You could take steps to get around this. The script also outputs any errors to a log directory. chmod to make the script executable, and create your target backup directory if it doesn't exist:

cd ~
sudo -uwww-data mkdir backup
cd backup
sudo -uwww-data mkdir mysql
sudo -uwww-data mkdir log
sudo -uwww-data vi dump_mysql.sh
... edit the file and save ...
sudo chmod ug+x ./dump_mysql.sh
... create the necessary database users and test:
sudo -uwww-data ./dump_mysql.sh
... check the output of the latest log file in ~/backup/log

Then, set this script to run before my backup in Duplicati (edit the job, on step 5, add a run-script-before-required advanced option:

Back up Jira

If you run your own jira (which, it seems, Atlassian plans to stop supporting), then you can use the built-in backup utility that comes with Jira, or just back up your Database and attachments manually. The latter will make a recovery more difficult, but it's easier to configure, and the resulting backup runs faster and takes up much less space since you'll only be saving changes as opposed to all of your jira data on each backup run.

In my case, in addition to my database this is all I need to back up my Jira attachments:

To make sure your jira is in a consistent state, I recommend stopping jira before the backup and starting it back up afterwards. This is simple enough. Create a stop_jira.sh script somewhere (I chose my /home/my_username/backup directory) and paste the following:

#!/bin/bash
sudo systemctl stop jira.service &> "$(date +/home/laci/backup/log/stop_jira_%Y-%m-%d_%H-%M-%S.log)"
exit 0

also create a start_jira.sh script:

#!/bin/bash
sudo systemctl start jira.service &> "$(date +/home/laci/backup/log/start_jira_%Y-%m-%d_%H-%M-%S.log)"
exit 0

Also make it executable!

You will probably need to allow your user to run the systemctl commands in the above files without reauthentication, for this we can follow one of the approaches described in Ubuntu – How to start and stop a systemctl service inside a bash script:

sudo visudo -f /etc/sudoers.d/MYUSERNAME

Then paste:

Cmnd_Alias JIRASERVICE = \
    /bin/systemctl stop jira.service, \
    /bin/systemctl start jira.service

MYUSERNAME ALL = (root) NOPASSWD: JIRASERVICE

Replace "MYUSERNAME" with your linux username in the above commands. This way your user can run sudo systemctl start jira.service without manual authentication.

Now, in your duplicati job, add run-script-before-required and run-script-after options:

Back up GitLab

GitLab has an extensive backup solution built in. You can configure that or keep it simple and just create a filesystem-based backup. Read the "Alternative backup strategies" section in the GitLab docs. Like with Jira, this is easier to set up, runs faster, and takes up much less space than having GitLab create backup files and backing that up. Users have reported success restoring GitLab from a backup of two important directories:

• /var/opt/gitlab
• /etc/gitlab

To make sure your GitLab is in a consistent state, I recommend stopping it before the backup and starting it back up afterwards. Create a stop_gitlab.sh script somewhere (I chose my /home/my_username/backup directory) and paste the following:

#!/bin/bash
gitlab-ctl stop &> "$(date +/home/YOUR_LOGIN/backup/log/stop_gitlab_%Y-%m-%d_%H-%M-%S.log)"
exit 0

also create a start_jira.sh script:

#!/bin/bash
gitlab-ctl start &> "$(date +/home/YOUR_LOGIN/backup/log/start_gitlab_%Y-%m-%d_%H-%M-%S.log)"
exit 0

Also make it executable!

Now, in your duplicati job, add run-script-before-required and run-script-after options like we did with Jira above (step 5, advanced options).

Issues

Backup starts failing with message "CERTIFICATE_VERIFY_FAILED"

Solution is to add the "accept-any-ssl-certificate" option to the given backup.

Manually Upgrading

Duplicati notifies you on the web UI if an update is available and you can usually install the update from there. In some versions this functionality is broken, you can then just install the latest version as follows:

xxx@www:~$ wget https://github.com/duplicati/duplicati/releases/download/v2.0.6.100-2.0.6.100_canary_2021-08-11/duplicati_2.0.6.100-1_all.deb
xxx@zensoft:~$ sudo apt install ./duplicati_2.0.6.100-1_all.deb

Find the latest release from https://github.com/duplicati/duplicati/releases

• How to set up scan to folder in "How to guides for Kyocera Devices"
• Scan to Folder via SMB from Kyocera MFD/MFP to Windows 10 by Kyocera (pdf) and link 2

In short:

1. Create a dedicated user in Windows that Kyocera will use to connect to it, you can run netplwiz for quick access to user management
2. Hide the user from the login screen by editing your registry, and creating a DWORD (32-bit) with the same key (name) as the dedicated user for Kyocera and with value "0" in the following location:
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList (if the path does not exist, create it)
3. Share the target folder in Windows using Advanced Sharing (just clicking on share will NOT work)
4. Give permissions to the folder for the dedicated user both in the sharing dialog (Folder Properties → Advanced Sharing → Permissions) as well as on the "Security" tab of the folder properties dialog
5. Ensure SMB is enabled on your Kyocera (log in as admin, Network Settings page, under "Send Protocols")
6. Create an address book entry on your Kyocera web control panel:

Address Book → Machine Address Book → Add

Tips:

• You can set the Host Name to the name of the computer, or if that doesn't work try to give a static IP address to the client and enter that
• The path should not start with a slash or the computer name!
• If you're on a domain, the username should be in the format: user@domain, otherwise: computer-name\user

You can also try Kyocera's ancient "Scan to SMB" utility, which will try to do the above automatically. It....sometimes works. Google it, or try to find it on this page.

If you got this far and it's not working, first take a moment and consider whether it would be easier to just set up

(a) configuring SMTP & delivering your scans via email, or

(b) an ftp server on the network & delivering scans there

Both take less than half an hour to set up and will work reliably. If you are intent on getting your Kyocera to work with SMB, then be prepared to spend hours troubleshooting the issue and boldly read on...

My favorite printer brands currently are Kyocera, Okidata, and Epson. All three companies continue to innovate, and they all offer affordable printers with very low cost of maintenance. I used to prefer HP until they got on the let's-rip-off-our-customers-with-overpriced-ink-and-disable-aftermarket-toners gravy train.

Unfortunately there is one issue that I keep running into with Kyocera printers. It has become very difficult to set up scannning to a computer via SMB lately. This is not all Kyocera's fault, these MFC-s still work fine with PC-s running Windows 7, and the problems often stem from "security improvements" and the general disaster that Windows has become. But Kyocera IS partly to blame because they are slow to adapt, and you can still buy Kyoceras with old firmware, and additionally they exacerbate the issue by not providing decent documentation and by "hiding" the software required to effectively troubleshoot the issue from the public. They rely too much on having a network of technicians worldwide - but many users don't want to spend top $ for a technician to fix an old printer or even to install a new one. These things should just work and if they don't, Kyocera should have an up-to-date guide published in a prominent location on the website with effective instructions to solve it as well as all software necessary (including firmware).

Anyways, I'm not an expert and I have no "magic" solution, this is just a post where I gather all useful suggestions I could find on this topic. Naturally, none of these come from either Kyocera or Microsoft itself.

The dirty word: "SMB"

The underlying issue often has to with SMB. Windows used to support SMB v1, but this has been disabled in newer versions of Windows 10. Certain Kyocera printers only support SMB v1, others require a firmware update to support SMB v2/v3, and newer devices support all three. You can read about SMB here. You can read about which printers support which protocol here. In case that link goes down, here's the relevand part:

KYOCERA devices that support SMB version 1, version 2 and version 3

• ECOSYS M2040dn - ECOSYS M4025idn - ECOSYS M4032idn - ECOSYS M8024cidn - ECOSYS M8030cidn
• ECOSYS M2135dn
• ECOSYS M2635dn
• ECOSYS M2735dw - ECOSYS M2540dn - ECOSYS M2640idw -
• ECOSYS M5521cdn - ECOSYS M5521cdw - ECOSYS M5526cdn - ECOSYS M5526cdw
• TASKalfa 3211i - TASKalfa 4011i
• TASKalfa 5052ci - TASKalfa 4052ci. TASKalfa 6052ci
• TASKalfa 2552ci - TASKalfa 3252ci
• TASKalfa 4002i - TASKalfa 5002i - TASKalfa 6002i - TASKalfa 7002i - TASKalfa 8002i
• TASKalfa 7052ci - TASKalfa 8052ci

These devices require firmware version 6 or higher

• ECOSYS M6030cdn - ECOSYS M6530cdn - ECOSYS M6035cidn - ECOSYS M6535cidn
• TASKalfa 3051ci
• TASKalfa 3501i - TASKalfa 4501i - TASKalfa 5501i - TASKalfa 6501i
• TASKalfa 3551ci - TASKalfa 4551ci - TASKalfa 5551ci
• TASKalfa 6551ci - TASKalfa 7551ci
• TASKalfa 8001i

These devices require firmware version 3 or higher

• TASKalfa 306ci - TASKalfa 356ci - TASKalfa 406ci

These devices require firmware version 5 or higher

• ECOSYS M3040dn - ECOSYS M3540dn - ECOSYS M3040idn - ECOSYS M3540idn - ECOSYS M3550idn - ECOSYS M3560idn - ECOSYS M6026cdn - ECOSYS M6526cdn - ECOSYS M6026cidn - ECOSYS M6526cidn - ECOSYS M2030dn - ECOSYS M2530dn - ECOSYS M2035dn - ECOSYS M2535dn
• TASKalfa 266ci
• TASKalfa 3010i - TASKalfa 3510i
• TASKalfa 2551ci

KYOCERA devices that only support SMB version 1

• TASKalfa 3050ci - TASKalfa 3550ci - TASKalfa 4550ci - TASKalfa 5550ci
• TASKalfa 1800 - TASKalfa 2200
• FS-1220MFP - FS-1320MFP - FS-1325MFP - FS-6025MFP - FS-6030MFP - FS-6525MFP - FS-6530MFP - FS-C8020MFP - FS-C8025MFP - FS-C8520MFP - FS-C8525MFP

Firmware Update

You should first check if your printer supports SMB2/3. If a firmware update is required, then don't even bother with any of the other solutions - I've tried them all and some printers simply don't work with Windows 10 without a firmware update. Unfortunately Kyocera does not make firmware updates available to the public.

You can check your firmware version on the Device Information → Configuration page:

Kyocera has release several tools for managing their printers. Personally I haven't figured out which is better or why there are so many tools. You can use Kyocera Net Admin (which is a "web-based" tool) or Kyocera Net Viewer, but there are others like "Kyocera Network Device Manager", "Kyocera Device Manager", etc. I used Kyocera Net Viewer because it's one of the smaller downloads. Unfortunately, it is not easy to find - use google. I found some up-to-date versions here: http://kyoceradocumentsolutions.hu/letoltesek/tartalom/579132, you can also try the "Quick Links" on Kyoceradiscovery.com

You will also need the updated firmware file. This is even harder to find. As I understand it, Kyocera only makes this available to authorized technicians. A shame because the end result is that many printers, which work fine, are thrown away when a firmware update is really all that is needed. Bad for the environment! I personally found some firmware on some russian site.

Once you got this far, google youtube for instructions on how to update your firmware with Kyocera Net Viewer. Or just follow this screen shot:

Default credentials are often: Admin/Admin

Turn on SMBv1

This is not recommended. SMBv1 was deprecated for a reason. But, there comes a point where you're ready to try anything.

You can enable SMBv1 by running optionalfeatures.exe, scroll down to SMB and tick SMB 1.0/CIFS Client (but not SMB 1.0/CIFS Automatic Removal)!

Some quotes:

Start the "Function Discovery Provider Host" and "Function Discovery Resource Publication" services, and then set them toAutomatic (Delayed Start).

When you open Explorer Network, enable network discovery when you are prompted.

(source)

So u just need to enable on win8 the SMB ver 1 with Powershell command : To enable SMBv1 on the SMB client, run the following commands:
sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi
sc.exe config mrxsmb10 start= auto

Firewall

Turn off your firewall to see if that is the issue. Turn off both your Windows firewall as well as any proprietary firewall you might have installed (like with antivirus).

Rules to set to allow for windows firewall:

• File and Printer Sharing (NB-Name-In), UDP 137
• File and Printer Sharing (NB-Session-In), TCP 139
• File and Printer Sharing (SMB-In), TCP 445
• File and Printer sharing (NB- Datagram-In), UDP 138

Getting desperate...

• Try using the IP address of the machine instead of the hostname
• Add exceptions in Windows Firewall (incoming, printers and file sharing, SMB)
• Turn on public sharing for the folder
• Windows 10 blocks SMB on public networks, check the network profile of the network you're connected to and set it to Private
• Check "Enable file sharing for devices that use 40- or 56-bit encryption" in "Advanced sharing settings", also enable "Password Protected Sharing"

Set these services to "Automatic":

• Function Discovery Provider Host
• Function Discovery Resource Publication
• SSDP Discovery
• UPnP Device Host

Further Reading / References:

• copytechnet forums
• Network security: LAN Manager authentication level
• Lots of other people having similar issues with Ricoh devices on technet
• Scan to Folder through SMB Scan is notworking in Windows 10 pro
• Scanning to windows 10
• Kyocera scan to folder setup
• Homegroup removed! How to get network sharing work with Windows 10 v1803.

1. I use Linode's own backup service
2. Duplicati to back up specific directories & mysqldump of my databases
3. Nakivo Backup to back up an image of each node to my QNAP NAS

For an overview of my backup strategy, as well as alternative software and solutions, see my post "Backing up a Headless Ubuntu Web Server (to Cloud & QNAP NAS)".

Misleading pricing on Nakivo's website?

Unfortunately, only after getting it all to work did I notice this little pop-up on Nakivo's website:

So, whereas on first glance you might think that a perpetual "Pro Essentials" license for a linux server would be $50, in fact you have to pay for "2 bundles of 5 servers", or $500!

If this doesn't bother you, or you are open to signing up for their subscription service (which is reasonably priced at $25/year/server but also with a minimum order of 10 licenses), then read on...

Setting up Nakivo Transporter on your Linode from your QNAP NAS

Before you start, install Nakivo Backup from the QNAP App Center:

You only need Nakivo Backup on your NAS. Install Nakivo Transporter only if you wish to use your server as a source for backup data, and you have the full Nakivo Backup program installed somewhere else.

The transporter component will have to be installed on your node, but Nakivo Backup will do that for you.

(1) Enable un/pw auth on your node

If you have a properly secured Linode, then you have username/password auth turned off. You will have to temporarily enable it for Nakivo to be able to log into the machine and install the transporter.

Although you could manually install the transporter on your node following Nakivo's docs, this is not useful because when you then try to add the machine in Nakivo Backup, it will try to install it again and complain that the transporter is already installed.

You could also use a private key with Nakivo, and then follow Nakivo's docs which instruct you as follows: "If you generated your key with a passphrase, you have to enter this passphrase into the password and repeat password boxes." But, this doesn't work, because the first thing Nakivo tries to execute is this: sudo bash -c set -e && set -o pipefail && [ -f "/etc/os-release" ] && cat /etc/os-release | grep '^ID=' | sed 's/[^=]*= *//' || ls but this fails because sudo asks for a password and Nakivo doesn't seem to supply it. So it seems to me that Nakivo simply didn't consider the possibility of using a private key along with sudo asking for a password. Bummer.

So, just enable username/password auth for your specific IP.

sudo vi /etc/ssh/sshd_config

Leave the line "PasswordAuthentication no" as is and add the following to the end of the file:

# Settings that override the global settings for matching IP addresses only
# Allow un/pw auth for home NAS:
Match address 111.222.333.444
    PasswordAuthentication yes

Save the file & reload sshd to apply:

sudo service sshd restart

(2) Allow Nakivo through your Firewall

You can configure which ports the transporter uses in Nakivo Backup:

The default ports are as you see above. You will have to allow  I use UFW so for me this was simple enough:

sudo ufw allow from 111.222.333.0/24 to any port 9446:10000 proto tcp

If you have a fix IP address you can specify that, or a subnet as I did. See How To Set Up a Firewall with UFW on Ubuntu 14.04 for help on setting up and using UFW.

Bonus: allow Nakivo through your Firewall using Dynamic IP Address

If you don't have a static IP address, you can use the method described in UFW: Allow traffic only from a domain with dynamic IP address.

Use a dynamic DNS service to keep a pointer to your IP address and then create a script such as the following:

#!/bin/bash
HOSTNAME=YOUR-DYNAMIC-DOMAIN
COMMENT=$HOSTNAME-Nakivo

if [[ $EUID -ne 0 ]]; then
   echo "This script must be run as root"
   exit 1
fi

new_ip=$(host $HOSTNAME | head -n1 | cut -f4 -d ' ')
old_ip=$(/usr/sbin/ufw status | grep $COMMENT | head -n1 | tr -s ' ' | cut -f3 -d ' ')

if [ "$new_ip" = "$old_ip" ] ; then
    echo IP address has not changed
else
    if [ -n "$old_ip" ] ; then
        /usr/sbin/ufw delete allow from $old_ip to any port 9446:10000 proto tcp
    fi
    /usr/sbin/ufw allow from $new_ip to any port 9446:10000 proto tcp comment $COMMENT
    echo iptables have been updated
fi

Make sure to update "YOUR-DYNAMIC-DOMAIN". Then create a cron job (in /etc/cron.d):

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

*/5 * * * * root { printf "\%s: " "$(date "+\%Y-\%m-\%d \%H:\%M:\%S")"; /home/USER/backup/ufw_allow_nakivo.sh ; } >>/home/USER/backup/log/ufw_allow_nakivo.log 2>&1

If you have your domain at Google Domains, you can easily set your up your QNAP NAS to update the record dynamically.

Google's article on the topic: Learn about Dynamic DNS

In your NAS, Control Panel → Network & Virtual Switch → DDNS, add:

in Google Domains on the DNS panel open "Advanced Settings" to add the dynamic domain name.

Once created, click "View Credentials" to get the credentials you need to enter into QNAP:

(3) Register the machine with Nakivo Backup

Open Nakivo Backup on your NAS and go to Settings → Inventory to add a new machine. Specify the display name, type, hostname etc.

It will take a few minutes for the transporter to be installed. Be patient.

You can check the progress of the installation of the transporter on the "Transporters" tab:

(4) Disable un/pw auth on your node!

Once Nakivo backup installs the transporter, you no longer need username/password authentication to be enabled on your node.

Done!

You can now define a new backup for your machine (Dashboard → Create → Physical machine backup), set up email alerts (Settings → General → Email Notifications), run a backup & dry-run a restore.

Tip: when creating your backup job, on the "Destination" page, click Advanced options...

...and now you can exclude a disk from the backup:

Also, make sure to just use the "Onboard repository". I tried creating a dedicated partition on the NAS, adding it as a target storage destination, but after I created backups there, I was unable to recover any files from the repository. Quite scary! So just use the "Onboard repository".

I also recommend enabling Network acceleration on the options page:

Nakivo has several outstanding security vulnerabilities at the moment, so consider reviewing Nakivo's Security Considerations before calling it a day.

Read my dedicated post on Backing up a Headless Ubuntu Web Server (to Cloud & QNAP NAS) if you're a web dev without a plan B!

If you're in a hurry, just check out my top pics, which are:

Macrium Reflect for backing up PC-s

The free edition is fine but I recommend forking over a few bucks and upgrading to paid. It's a perpetual license and in this day of corporate greed lead by Adobe we should appreciate companies that still offer perpetually licensed products. I personally got the workstation edition which comes with a free! central management console. I've also deployed it at all of my clients where we are backing up dozens of computers and it works mostly great. Well, there are issues sometime but nothing's perfect.

Duplicati for backing up Linux boxes to Cloud (or most other destinations)

Read my other post where I detail all the software I checked out! It's free and it's absolutely fantastic! It comes with a web-based UI, it's super fast, the recovery process is painless, and it has a lot of options such as email notifications/http ping/pre- post-exec scripts and so on.

Backblaze as your cloud backup destination

because it's cheap, the pricing is simple & transparent, and it's easy to use.

QNAP NAS for backing up locally on your LAN

but why stop there, set up some VM-s on it and have a home server, upgrade your home lab to 2,5 gigabit (they have 5 gigabit as well but trust me it just doesn't work...we're just not there yet). QNAP also comes with some free backup software you could to back up your PC-s but...it doesn't compare to Macrium. Their Sync software is not bad however.

GoodSync, Syncovery, or FreeFileSync for manual, scheduled, or quasi-continuout syncing of files

across laptops, or between your home NAS and your laptops. These programs can sync files on a schedule or watch your filesystem for changes and sync on-the-fly.

Syncthing or Resilio Sync for continuous sync

much like google "Backup and Sync" except between your own devices. These work differently than the aforementioned manual and scheduled sync programs and are built on fundamentally different algorithms.

Some other tools that I've tried...

(but did not end up using):

URBackup

BackupPC

MSP360

CloudBerry Backup

Syncovery

And even more tools that looked good

but I didn't try:

SpiderOak One

CrashPlan

Duplicacy

Veeam Agent for Microsoft Windows FREE

Some Background

My main business is software development, however as an "added bonus" we also provide basic services for our clients (which are small businesses). So, I am not an MSP with hundreds of clients & matching experience. Still, in this post I'd like to share my research & experience ensuring that my clients have a proper backup strategy in place. Of course, haters will argue that a business should pay a "proper" MSP to handle IT infrastructure and I won't argue with that. But small businesses can't always afford such top-tier services...and MSP-s often don't even wish to deal with clients where there are only a few machines. In any case, I'm not trying to give anyone advice, but perhaps writing this post will help someone else in a similar situation.

If you speak Hungarian, I also have a more general overview post about backup strategies here: Tudatosan a biztonsági mentésről

Also, please read The 3-2-1 Backup Strategy if you are unfamiliar with the term.

My other posts in this topic:

• QNAP NAS & Backup Software Experiences
• Macrium Reflect Troubleshooting

Why not just Google Drive/OneDrive/DropBox?

I will quote from an email I wrote:

With regards to online services, again we have to differentiate between cloud storage and online backup. Cloud storage is like Google Drive or Microsoft OneDrive or DropBox business. Online backup is if you actually create a backup of the machine itself.

Really we should consider what risks we are aiming to mitigate.

Ransomware viruses are a pain because they encrypt all files on the machine, and any files on the network that the machine has access to. Google drive isn't a good solution to this because the computer will synchronize the encrypted files to google drive, thus overwriting the originals there. You can see "previous versions" of files with google drive but it becomes very cumbersome to manually sort through all files and see what was encrypted and what wasn't.

DropBox for Business seems to be a better option because they have some features specifically for this, called "DropBox Rewind". You can read about it here, the faq here, and a how-to here. So if we are considering using cloud storage to mitigate a possible ransomware attack, then DropBox seems to be a good solution. The cost is $15/user/month for DropBox Business Advanced. This plan includes the rewind feature as well as the ability to sign in as another user, so you could get access to the files of any of your employees if you wanted.

So, cloud storage is a great strategy for sharing files & having some level of protection against ransomware. But it has its limitations, and data loss often occurs due to a human error, or even thanks to a disgruntled employee.

A diary of software I tried or just considered...

IDrive (SAAS) 👎

IDrive: it seemed like a great solution at first. Very attractive pricing & the software has a good balance of features and ease of use. Right now it's $52 for 5TB for the first year for unlimited computers! There are lots of good reviews out there, but I suspect many of these are paid. I also read many negative reviews where customers complain about being charged extra for using "extra" space. So, basically, they offer great deals on storage, and then when your backup fills up, instead of deleting old backups (or doing some version of incrementals forever), they start charging you extra. Also, the offers are for the first year only! Now I'm sure IDrive works great for many customers but tactics like this really put me off so I continued my search.

VEEAM 👍

VEEAM is more geared towards enterprise customers but the have several free backup solutions, as well as an affordable package for SMB-s.

Here's an excellent comparison of VEEAM and Macrium: Macrium Free vs Veeam Agent Free Review

To be continued...

Read my dedicated post on PC backup software if that's what you're after!

I use several Ubuntu-based VM-s hosted at Linode, which fulfill various roles (web server, JIRA, knowledgebase software). Of course I already pay for Linode's in-house backup solution, which is reliable & has saved me in the past. It is great if you have a serious issue with your whole node & need to restore it to a day ago. However, it has some limitations:

• If Linode goes bust or accidentally deletes my account (I've read about such cases, although I'm not sure if they were resolved) or some other unforseen event occurs then having backups with Linode is not much use
• Restoring such backups is a pain -  you have to spin up a new node & restore there, even if all you want is a file from a few days ago
• And in any case it's good to have several indepentent backup strategies, & setting up file-level backup provides for a good opportunity to take inventory of what is worth backing up!
• It would be nice to have a central console where I can monitor all of my backups! In any case, email notifications are a must.

There is a whole discussion on the drawbacks of Linode backups Is it just me, or is the Linode backup service about useless.

So, I've spent the last few days trying to identify a reliable, modern, & inexpensive solution for creating backups of these servers. I'm documenting my findings here mostly for myself, but I figure there must be many other devs out there who might benefit from my experiences.

Note that none of the links here are affiliate links and I haven't received any compensation for any of this. If you find it useful, please leave a comment below! I'm also open to any advice.

My primary goals were:

• Must be able to back up from headless Ubuntu servers to cloud or my QNAP NAS (which is not directly accessible from the internet)
• A reliable solution, so it must be fairly popular, and it must also be efficient (compression) and fast
• I have no intention of paying a subscription fee for the software itself, but I don't mind paying a reasonable price for perpetually licensed software
• Set-up must not be too complicated!
• I don't want to buy through a reseller

In the end I settled on a three-pronged approach:

(1) Linode's existing backup service (which I already had)

(2) Duplicati backing up specific directories to Backblaze B2

Read my dedicated post on Off-site Backup of your Ubuntu Linode with Duplicati (with MySQL, Jira, and GitLab) + Healthchecks.io if you go with Duplicati!

(3) Nakivo Backup running on my home QNAP NAS & backing up the whole node there (NOTE! There are 2 security advisories out at the moment with regards to Nakivo Backup!)

Read my dedicated post on how to Backup your Ubuntu Linode to your QNAP NAS with Nakivo if you go with Nakivo!

Looking at pricing on Nakivo's website, you might think that you can get a perpetual license for $50/server. What isn't obvious is that you have to place a minimum order of 10 licenses! So keep that in mind before going with Nakivo. And shame on them for not making this more obvious - or even having this silly condition in the first place.

Some "runner-ups" that I actually installed and tried:

• Syncing certain directories to my NAS using QNAP's built-in "Hybrid Backup": well this only works with plain FTP or certain cloud providers, so it was not an option for extracting data from my nodes.
• URBackup: I was not able to get the client on the node to communicate with the server because the communication is initiated from the client to the server and not the other way around.
• MSP 360: centrally managed from MSP360's website. Worked, but there's no way (that I found) to browse what was backed up, or to restore individual files. Also, subscription pricing starts at $360/year.
• CloudBerry Backup (now also owned by MSP 360, but kept as a separate product) for backing up from the node to B2 cloud. It worked but quite slowly, I suspect because it seemed to upload each file individually instead of in a zipped backage.
• Syncovery for syncing from the node to the NAS, managed and initiated from the NAS through a web-based UI, via SFTP over SSH+certificate. Worked well although it ran very slowly.

And a list of "must-reads":

1. For an extensive list of backup software that works on Linux, see restic/others
2. For a similar blog post that focuses on a CMD-only solution ,see "I found the Holy Grail of backups" by Stavros Korokithakis
3. For some interesting technical reading on how backups work under the hood, see Duplicacy's github page, especially the section "Comparison with Other Backup Software"
4. The 3-2-1 Backup Strategy

"Planning"

At first I was really at a loss as to how to approach this problem. There are so many backup solutions out there, literally hundreds, and the proliferation of marketing BS these days makes it difficult to get answers to even simple questions like does this backup solution run on headless Linux? There are also dozens of open-source solutions, many of which are free, and many which are no longer maintained. So I wasn't sure what I want. Do I want to create incremental backups on a schedule? Or do I want to just sync my files somewhere? Do I want to back up to a cloud provider? How much would that cost? Or should I just back up to my NAS? Do I want to manage the backup from the source server or centrally? Centrally from a SaaS website or from my NAS? Really, the task seemed more intimidating the more I researched!

After a bit of thinking some things became clear to me:

• If I want to back up to my NAS, the communication has to be initiated from the NAS (because I don't want to open the NAS up to the WWW, I've had a QNAP hacked before! and it's on a dynamic IP anyway which I could work around but I like to KISS)
• Running software in an Ubuntu VM on my NAS isn't a good idea because of performance issues

Sequential throughput is always reduced through VMs regardless what else the VM is doing (like random/IOPs type work) so would affect something like backup...Lots of Qnap people running VS starting to see this.

• I can install any web-based solution on my Linux nodes and then just create a tunnel with Putty to access it as described in Relica's docs

Cloud Backup Storage Providers

Well, there are many and you can do your own research. For me, the top two are

1. Backblaze B2 because...it is simple to use, with straightforward pricing, and it's fast and super cheap
2. rsync.net - also cheap, and I'd use it if I used something like borg/rsync/restic

BaaS

First, I started looking at backup as a service providers. I only found a few that actually support headless Linux hosts:

IDrive 👎

IDrive: it seemed like a great solution at first. Very attractive pricing & the software has a good balance of features and ease of use. Right now it's $52 for 5TB for the first year for unlimited computers! There are lots of good reviews out there, but I suspect many of these are paid. I also read many negative reviews where customers complain about being charged extra for using "extra" space. So, basically, they offer great deals on storage, and then when your backup fills up, instead of deleting old backups (or doing some version of incrementals forever), they start charging you extra. Also, the offers are for the first year only! Now I'm sure IDrive works great for many customers but tactics like this really put me off so I continued my search.

SpiderOak One 👍

SpiderOak actually looks like a good solution. Their pricing is decent, and they have packages that can be installed easily on APT-based distributions as well as many other operating systems. I did not end up trying them because eventually I found Duplicati, which, with B2 as a storage destination, comes out cheaper. SpiderOak also doesn't seem to have a central management console, and their website is quite lean on providing any technicals. Their support is also according to this post by JGM not very good. Also see:

• WHAT ARE THE APT SOURCES LINES FOR SPIDEROAK?
• How to Install SpiderOak One on Ubuntu

CrashPlan 👍

CrashPlan came out on the top of my list after reading various reviews as well as many forum posts. They provide unlimited storage for $10/device/month. I think they provide an excellent product and I might use them one day - but my nodes cost $10-$20/month, so paying almost the same for backup seems excessive. Also see:

• Compare Crashplan Against Other Cloud-Based Backup Services

Duplicacy 👎  ♢   3,4k ★ on GitHub

I'm listing this in the SaaS section because they charge a low subcription fee, even though duplicacy does not itself provide cloud storage. I am very much against subscription software that doesn't actually provide an ongoing service. Yes, it's great for the developer but not so much for the user. There is actually a whole discussion about this on their forums where they defend why they don't provide a perpetual license. Yeah...no thanks.

I actually did consider it because it seems to be quite perfect. A good, web-based UI, cross-platform support, and technically an excellent solution.

Duplicacy is the only cloud backup tool that allows multiple computers to back up to the same cloud storage, taking advantage of cross-computer deduplication whenever possible, without direct communication among them. This feature turns any cloud storage server supporting only a basic set of file operations into a sophisticated deduplication-aware server.

They have an excellent technical discussion of why they are better than some of the alternatives which is worth reading. Here's an excerpt:

Other SaaS backup solutions to consider:

• BackBlaze Backup
• Relica Backup (only $5/year!): seems nice but the user guide is quite shallow, although they have a good article on Accessing Relica Remotely

Commercial Solutions (perpetual license)

Nakivo Backup 👍👍👍 ← TOP PICK!

I found Nakivo because they have a package on the QNAP "store". It is surprisingly good! One drawback is that it cannot do folder/file-level backup, it backs up the whole machine. But I think that's fine, as I also back specific folders up to the cloud. Pricing is perpetual and quite reasonable. Note: there are 2 security advisories out with regards to Nakivo! Also see:

• Installing on Linux
• How to Install Nakivo VMware Backup & Replication tool on Linux
• How to install Nakivo Backup and Replication on Linux

Backing up 50GB took an hour and nine minutes:

Restore is easy peasy as well. You can select to restore only certain files/folders, or the whole machine. You can download the files or restore to various types of destinations. It supports email notifications, and you can run a pre- or post-execution script (but only on the server, not on the client that you are backing up!). You can even re-brand the app if you like (good for MSP-s)! It's fast and it works.

CloudBerry Backup for Ubuntu 👍👍

I installed CloudBerry and set it up with BackBlaze. By default it runs a web server on port 43210, which I tunneled to localhost with Putty. It worked. The interface is pretty slick as well:

However, note that uploading 360 MB to BackBlaze took 26 minutes! I backed up the same directory with Duplicati in one minute and ten secods half hour before!

I tried turning off compression to see if that would help, but no. Perhaps its a misconfiguration on my end but...that is still 25x slower than Duplicati, which is free!

Also see:

• Cloudberry Backup for Linux Server (web interface)

Enterprise & MSP Solutions

There are also a number of enterprise solutions that are able to back up Linux machines. These are usually quite expensive (hundreds of $ / server / year), but there are exceptions. For example,

VEEAM

Veeam offers an agent for Linus for free. Although I did not try it, VEEAM certainly looks like a great solution. Lots of people mention it on various forums. If I were a larger MSP, I'd try them out for sure. The Linux agent can be controlled from the command line, or from a console UI.

It can also work well with their centrallized Veeam Backup & Replication solution, which is available in various licensing schemes, one of which is geared towards small MSP-s at 348 Eur/year for 5 licenses ("Veeam Backup Essentials"). What put me off most was that you can only purchase VEEAM through a reseller, and in places like Hungary the reseller is inevitably also an MSP, so if I bring them into the picture then they will try to just take over my clients :-(

But perhaps one day I will give VEEAM a try. They have a backup solution for almost any kind of device you'd like to create backups from.

MSP360 👍👍

I gave MSP360 a try. You get a central control panel (hosted by MSP360) where you can manage all of your backups. They also support various datasources, including Linux. It does work, albeit not too quickly. There is also no way to recover specific files, or even any kind of file browser where you can dig into your backups. Really their aim is to provide a whitelabel solution for MSP-s that offers backups as part just one service of several. As such, it's more of a swiss army knife for MSP-s - good for many things, but not great for anything specific. If I want to remote into a machine, I'll use SplashTop or AnyDesk thank you.

Also see:

• MSP360 Backup & Backblaze B2 Cloud Storage

I ended up uninstalling...but this is a comprehensive solution I'd like to keep my eye on! I couldn't find any screen shots on their website so here you go:

Other enterprise-geared solutions:

• Altaro: very expensive
• Datto: no pricing, only available through resellers

Open-Source Solutions (with a Web UI)

Duplicati 👍👍👍  ♢   5.5k ★ on GitHub ← TOP PICK!

I found out about Duplicati from a post by Jim Mendenhall and I kept coming back to it. I eventually ended up using it with BackBlaze B2.

Duplicati is a free, open source, backup client that securely stores encrypted, incremental, compressed backups on cloud storage services and remote file servers. It works with: Amazon S3, Backblaze (B2), Box, Dropbox, FTP, Google Cloud and Drive, HubiC, MEGA, Microsoft Azure and OneDrive, Rackspace Cloud Files, OpenStack Storage (Swift), Sia, Tardigrade, SSH (SFTP), WebDAV, Tencent Cloud Object Storage (COS), and more!

One drawback that put me off was that it cannot be managed centrally - you install Duplicati on the machine you wish to back up. However, I ended up trying it out and I was very impressed. The web-based UI is excellent, and it was extremely fast backing up to BackBlaze. 500 MB uploaded in a little over a minute!

Restore also worked perfectly, propery restoring file permissions as well!

Also see:

• Backup your linux server with Duplicati

UrBackup👍👍  ♢   0,8k ★ on GitHub

UrBackup is an easy to setup Open Source client/server backup system, that through a combination of image and file backups accomplishes both data safety and a fast restoration time.

Like BackupPC, UrBackup is a centralized solution. There is also a custom package for QNAP, so it's quite easy to install. I installed it both on my NAS as well as on one of my Ubuntu nodes, but I wasn't able to get them to connect - I believe because with UrBackup, the client must reach out to the server (and not the other way around). The docs confirm this suspicion:

UrBackup is able to backup clients over the internet, enabling mixed LAN and Internet backups. This can be useful e.g. for mobile devices which are not used in the LAN all the time, but are connected to the Internet. As it causes additional strain on the backup file system this feature is disabled by default. You need to enable and configure it in the settings and restart your server to use it. The minimum you have to configure is the server name or IP on which the backup server will be available on the Internet.

Also see:

• Install client on Debian or Ubuntu from sources
• Howto fully uninstall urbackup client on Ubuntu

BackupPC 👍👍  ♢   0,8k ★ on GitHub

BackupPC was also at the top of my list because it is well-maintained and it is a server-client solution, where you install BackupPC onto a server which then pulls backups from the various client machines via rsync or SMB. The server is configured through a web UI. Unfortunately, it is not so simple to install on a QNAP NAS, and if you install it on a VM it runs quite slowly, and getting it to run on one of my Ubuntu nodes proved cumbersome. However, it is an excellent solution that I might try out some day!

BackupPC is a high-performance, enterprise-grade system for backing up Linux, Windows and macOS PCs and laptops to a server's disk. BackupPC is highly configurable and easy to install and maintain.
Features:
- Web Interface
- Data deduplication
- Compression
- Open-source
- No client software needed

Also see:

• Installing BackupPC 4 from tarball or git on Ubuntu

Bacula

Build Your Free Enterprise Backup Software System with Bacula Tools

Bacula is an interesting solution that I would love to try out one day. However, at the moment it seems overkill. It is really geared towards enterprise environments, with various components that must be set up with care and maintained over time. Too much work to back up a few virtual machines!

Open-Source Solutions (CMD only)

I also stumbled upon several highly touted open-source solutions which do not have any kind of GUI. These are excellent solutions I'm sure but I'm a big fan of having a UI since it makes configuration & monitoring so much easier. So I will list these for reference only, I did not try any of them, since I like a GUI and also most of these only run on flavors of Linux:

Borg backup 👍   ♢   6.6k ★ on GitHub

Loved by many! Large and active community. Latest update was 22 hours ago (as of 10/12/2020). Check out the docs for more info.

Restic 👍   ♢   11k ★ on GitHub

Another great CMD-only backup solution with an active community. Restic supports a wide variety of backends.

Duplicity

Duplicity is actually a command line backup program that allows to backup directories by providing an encrypted and digitally signed version tar-format of the volumes that can be uploaded to a remote or local file server. (from: How to Backup Files with Déjà Dup and Duplicity on Ubuntu 18.04 LTS)

There are many, many more - I recommend searching on github to see what is maintained.

Clients with Desktop GUI

There are also various notable solutions out there that are dedicated to Linux and come with some kind of GUI, some of these are multi-platform as well.

qBackup

A backup solution straight from Japan. Minimalist but multi-platform, and it supports cloud destinations as well.

BackInTime

Back In Time is a simple backup tool for Linux, inspired by "flyback project".

Kopia   ♢   0.34k ★ GitHub

Kopia is a simple, cross-platform tool for managing encrypted backups in the cloud. It provides fast, incremental backups, secure, client-side end-to-end encryption, compression and data deduplication.

Timeshift   ♢   2.4k ★ GitHub

Timeshift for Linux is an application that provides functionality similar to the System Restore feature in Windows and the Time Machine tool in Mac OS. Timeshift protects your system by taking incremental snapshots of the file system at regular intervals. These snapshots can be restored at a later date to undo all changes to the system...
Timeshift is similar to applications like rsnapshot, BackInTime and TimeVault but with different goals. It is designed to protect only system files and settings. User files such as documents, pictures and music are excluded. This ensures that your files remains unchanged when you restore your system to an earlier date. If you need a tool to backup your documents and files please take a look at the excellent BackInTime application which is more configurable and provides options for saving user files.

Déjà Dup

Simple backup tool for GNOME. A trivial-to-use personal backup tool to protect against accidental data loss.

Deja dup comes preinstalled with many Ubuntu deployments. It is basically a GUI for Duplicity.

Underlying Technologies / Scripts

I also wanted to list some of the underlying libs that many of the above backup solutions make use of. It's also quite possible to "just write a script" which makes use of these yourself...but as fulfilling as doing so might be, this was not the solution I was looking for.

rsnapshot   ♢   1.8k ★ GitHub

rsnapshot is a filesystem snapshot utility based on rsync. rsnapshot makes it easy to make periodic snapshots of local machines, and remote machines over ssh.

Scripts!

• Automatic Offline File Backups with Bash and Rsync by Nick Janetakis

Synchronization Software

I also considered using some kind of sync software to simply regulary copy over the most important files form my server to my NAS. Some I considered were:

Syncthing (continuous sync)

I've used Syncthing for a while and prefer it to Resilio. It seems to be better maintained and the UI is more intuitive for me to use. I'm assuming it wouldn't work in my situation because for the NAS and the Ubuntu machine to communicate, the communication has to be initiated from the NAS (since it's behind a firewall & I prefer to keep it this way).

Resilio Sync (continuous sync)

A good sync program I use to sync my phone data to my NAS. They also have a package for Linux, see:

• Installing Sync Package On Linux

GoodSync (manual sync, for Windows)

I also use GoodSync at home. Unfortunately, they recently got on board the subscription-software-gravy-train, and I'd prefer to skip the ride. In any case it is Windows-only software.

Syncovery

Syncovery has a package for QNAP which provides a web interface. I managed to configure it to log into my Ubuntu node via SSH using a certificate. Very impressive! Their web ui could really do with some styling though, and transfer speeds were quite slow (~40kb/s). Perhaps in the future I will use Syncovery again!

FreeFileSync

Also see: How to Install FreeFileSync 10.25 in Ubuntu 20.04 LTS

Alternative Solutions:

Here are some more names I came across during my research. I skipped over these since they didn't look like a good match:

• OpsMate: this looked promising but it seems to be in perpetual beta with an online "Request Invite" form to sign up?
  "Opsmate backs up your Linux servers securely, for a fraction of the cost and effort of alternatives."
• CPanel or another "Control Panel" with built-in backup. CPanel has quite a high subscription cost though. Some free/cheaper alternatives: Vesta Control Panel, Virtualmin
• JetBackup: backup solution for CPanel/WHM, they also have a stand-alone backup package. Subscription software.
• CloneZilla: outdated sync & clone software.
• odrive backup & how to install on linux
• Xopero backup (has a qpackage for easy install on a QNAP NAS)
• R1Soft Server Backup Manager from ConnectWise
• HandyBackup - quite expensive if you want to manage centrally, and they basically offer ftp-based "backup" for linode servers. See screenshots.
• Bakop: subscription software, they offer their own storage...supposedly, but they charge an arm and a leg for it

QNAP NAS Packages

Here are some other backup/sync solutions specifically for a QNAP NAS, as well as some that have dedicated packages for QNAP:

QSync

Qsync has an Ubuntu client, although I think for this to work the two machines have to be on the same network.

Veritas Backup Exec

Seems like somewhat outdated & I couldn't find any pricing info on their website. They are compatible with many OS-s. There are also some negative reviews shared on the net:

Very Expensive compared to other backup solutions available now in the market like Veeam, Altero which also have some backdrops like unable to backup physical machines but good comparable solutions. Veritas license for each module is very expensive. Need to buy license for each agent and a server core license and if at all if we need to use more than 1 drive to run the backups , we need to buy extra Library expansion option licenses along with core license.
In present days we have many issues with backing up several servers and with sql server instances. Support asking us to create separate jobs for drives on the servers and Sql server or My sql instances, which doesn not make any sense and after doing that too, the jobs fail. The jobs success has become very inconsistent now a days. We are on Backup exec 16 and they say that they cannot support SQL server 2017.

Several bugs found but Veritas seem incapable or unwilling to acknowledge them, seem to have no way of reporting them either, I was directed to a page for suggesting Functionality and Ideas.

The following I've written about above, but I'll include links to the QNAP-specific packages here:

Syncovery

Duplicati (889k downloads)

QUrBackup (201k downloads)

Duplicacy (62k downloads)

Duplicity (26k downloads)

Bacula (10k downloads)

BorgBackup (9k downloads)

Sources/further reading:

• Restic: others (TIPP!)
• Linode docs: Backing Up Your Data
• 25 Outstanding Backup Utilities for Linux Systems in 2020
• 5 Online Backup Solutions for Ubuntu Linux
• Carbonite vs CrashPlan: Picking SMB Backup in 2020
• Reddit: Offsite Backup - Crashplan vs. Backblaze?
• BACKBLAZE VS. CRASHPLAN – COMPARISON OF CLOUD BACKUP SOLUTIONS
• Comparing SpiderOak ONE and CrashPlan Home
• Backing up your computer — which program is the best? BackBlaze, SpiderOak or CrashPlan?
• BackBlaze - Looking for Additional Options to Backup Your NAS?
• How to configure Backblaze B2 with Duplicity on Linux
• How to configure Backblaze B2 with Restic on Linux
• How does Backblaze support Linux Users?
• Alternatives to Duplicacy for Linux with any license
• Top 5 alternatives to CloudBerry
• CloudBerry Backup Review (check comments)

From Linode forums:

• Offsite Backups HOW-TO
• What's a decent way to backup a linode
• Backup options

To get started, make sure to install the Rainlab Translate plugin on your site and read their documentation!

Basically, first set up languages on the backend "Manage languages" tab.

Then, on any CMS page or layout etc. instead of writing a simple string, "My Great Website", write {{ 'My Great Website'|_ }}

You can then go to your backend, "Translate Messages" tab, click "Scan for messages", and add your translation.

Pluralization (None? One? Many?)

October makes use of (or at least used to make use of) the Laravel tans_choice() function. Here are examples of using 2 or more "choices":

Two choices:
{{ 'There are no apples|There are :number applies!'|__(2, { number: 'two' }) }}

Several choices:
{{ '{0} There are no apples|{1} There is one apple|]1,19] There are :number apples|[20,Inf[ There are many apples'|__( 3, {number: 'three'} ) }}

Reference: Translate plugin issue #144

Overriding translations of plugins

Not everything is available for localization from the back-end "Translate messages" page. Plugins can also define language files, which are located in the "lang" folder of the plugin. But you can override this by copying it to a root "lang" folder in your site.

So, for example, to add hungarian translation (language code "hu") to the nifty GDPR plugin, first find the original english translation file. It is in: /plugins/offline/gdpr/lang/en/lang.php

Now, create a folder and copy-and-paste the lang.php file into it: /lang/hu/offline/gdpr/

As you can see the folder structure is somewhat backwards to how it is with the plugin, but that's fine. Then, simply edit the file and add your translations!

You could also just override the original strings by creatint the file in /lang/en/offline/gdpr/

Static Menus Don't Heed Default Language?

I've run into an issue where you set language X as your default language in Backend → Translate → Manage Languages, but despite this your menus set in the pages plugin show up in english. The solution that worked for me was posted in the OctoberCMS forums "Static pages menus sometimes doesn't switch to localized url and title":

...My solution was changing default locale in config/app.php same as locale in backend, translation plugin...

So just find and update the locale setting your config/app.php:

Nem vagyok szakértő a témában, viszont pár tapasztalattal már gazdagodtam az elmúlt 26 év során, mióta számítógépekkel van dolgom, kezdve az első (és utolsó) komoly adatvesztésemmel, amit még a 2000-es évek elején szenvedtem el egy korrumpálódott merevlemez miatt. Az alábbi szöveget ezért ne vegye senki se szakmai tanácsként, ahogy szokták mondani, "konzultáljon háziorvosával" de legalább is az informatikusával a helyes mentési stratégia felállításával. Na de vágjunk bele...

A jó mentési stratégia három lábon áll:

(1) A sámli első lába: mentések készítése

a) Mentési terv

Ideális esetben legjobb tudatosan kitervezni, hogy miről milyen  gyakorisággal készüljön mentés. Ehhez jó egy risk analysis, amiben  leírjátok, hogy milyen veszélyforrások vannak, mi a valószínűsége, hogy  bekövetkezik bármelyik, és milyen lépést tesztek azért, hogy ne  követezhessen be, vagy ha bekövetkezik, lehessen a kárt minimalizálni.  Különböző veszélyforrások közé tartozhat a vírustámadás (de akár egy  windows 10-es frissítés is törölheti a vinyót - ez anyámmal történt  meg), hardver meghibásodás (ha egy SSD elszáll akkor arról nem fogsz  visszanyerni adatot, ez egyik ügyfelemnél történt), vagy betörés/rablás,  tűz, esetleg elégedetlen alkalmazott kiszereli a lemezt a gépből (ez  egy másik ügyfelemnél ez volt), stb. Olyanra is kell gondolni, hogy mi  van, ha nem veszed észre azonnal a problémát, mondjuk egy lemez lassan  kezd meghibásodni és csak egyes fájlok tartalma korrumpálódik, és ezt  csak hónapokkal később veszitek észre.

b) Mentések felállítása

A következő egy alap szintű de véleményem szerint kielégítő mentési stratégia magánszemélyek, vagy kisebb vállalkozások számára:

• Legyen minden fontos gépről automatizált napi mentés egy hálózati merevlemezre. Ideálisan a hálózati lemez egy NAS eszköz ami Linux alapú OS-en fut és támogat hitelesítést, és  csak a mentést elvégző programnak szabad, hogy meg legyen a szükséges  hitelesítési infó az írásra. Egy ilyen hálózati eszköz kb 100e ft-nál kezdődik.
• Továbbá havi gyakorisággal készüljön mentés egy külső tárhelyre - ez lehet egy külső vinyó, amit nem az adott helyiségben tárolsz, vagy egy online backup szolgáltató, akár ftp szerver, stb. Ha két NAS-od van, akkor ezt elég könnyű megoldani, mivel az ilyen eszközök (általában) alapból nyújtanak olyan funkcionalitást, ami lehetővé teszi az adat folyamatos vagy ütemezett mentését egy másik hasonló eszközre akár a neten keresztül is. Az egyiket otthon, a másikat a munkahelyeden vagy egy rokonnál helyezed el és beállítod a havi vagy heti szintű szinkronizálást.
• Emellett a legfontosabb dokumentumokat érdemes feltölteni a felhőbe  is, akár google drive backup & sync-kel vagy Microsoft OneDrive-al,  vagy egy másik szolgáltatóval. Vírus támadás esetén az ott tárolt fájlok  is felülíródnak, viszont általában vissza lehet állítani a korábbi  verziókat, noha macerás.

(2) Mentések rendszeres ellenőrzése

Jó dolog az automatizálás, de előfordul, hogy valami megváltozik a  környezetben, vagy a mentés nem volt jól felállítva, vagy valami más okból mégsem készül el egy idő után a mentés. Ezért fontos egy élő embernek legalább havi egyszer ránéznie és ellenőriznie, hogy minden működik-e, ahogy kell.

Még jobb, ha pár havonta begyakoroljuk, hogy mit tennénk, ha  valamelyik mentésre szükség lenne. Tehát mondjuk kitaláljuk, hogy egy  pár adott fájlról kellene a 3 hónappal ezelőtti verzió - vissza tudjuk  állítani?

(3) Helyreállítási terv

Végül pedig ami majdnem olyan fontos, mint a jó backup stratégia: nem  elég felállítani a mentéseket, kell dokumentálni is az egészet. Kell  egy "helyreállítási terv" dokumentum, amiben le van írva, hogy miről,  milyen gyakorisággal, hova készül mentés, és hogyan lehet azt  visszaállítani. A tervben le lehet írni a mentés tesztelésének menetét  is. Ha nincs ilyenetek, vagy nem kaptatok az informatikusotoktól,  kérjétek meg, hogy írjon. Mert szép és jó, hogy az ő fejében meg van az  infó, de mi van, ha nem elérhető, vagy már nem dolgozik nektek, vagy a  helyreállításért egy vagyont kér el? Inkább legyen egy terv  dokumentumban leírva minden szükséges lépés, hogy akár ti is vissza  tudjátok állítani az elveszett adatokat.

Helyreállítási tervről egy remek blog postot írt Apáti Sándor, ajánlom mindenkinek!

És egy pár ijesztő anekdóta, amit személyesen hallottam:

• A könyvelőm irodáját nem rég támadta meg egy ransomware vírus, a legtöbb gépen titkosította a fájlokat. Az informatikusuk több hónappal ezelőtt készített manuálisan mentést, ami ezerrel jobb, mint ha nem lett volna semmi! De így is több havi munkát kell most újból elvégezniük.
• Egyik ügyfelemnél az irodavezető saját gépét támadta meg pár hónapja egy ilyen vírus. Egy emailt kapott, ami arra kérte fel, hogy frissítse a PDF olvasóját a kapott linken keresztül...nem kellett volna rákattintani. Sok évnyi fénykép és személyes fájl titkosítva lett. Elmondása szerint látta, ahogy a desktopján sorra megváltozik a fájlok kiterjesztése. Sajnos nem tette azt, amit ilyenkor azonnal kell: nem húzta ki a gépet azonnal a falból!
• Egyik ügyfelemnél az egyik kedves kolléga, akinek nem tetszett, hogy megszűntetésre került a munkaviszonya, elég barbár módon (gondolom késsel vagy bicskával) kiszerelte a telephelyén használt laptolból a merevlemezt.
• Egyik ügyfelem elmondása szerint az egyik sikeres vállalkozó ismerőse is pár hónapja ransomware áldozata lett, minden odaveszett, a kár felmérhetetlen.
• Pár hónapja az egyik ügyfelemnél az egyik laptop egyik pillanatról a másikra leállt. Egy gyors teszt kimutatta, hogy az SSD lemez dobta fel a talpát. Semmit nem lehetett róla megmenteni. A régi, mágneses lemezeknél ez nem így volt, ott azért az esetek 99%-ban az adat jó része menthető volt ha sokba is került. Az új, elektromos SSD-knél és pen drive-oknál viszont ez gyakran nem így van: ha behal a kontroller, akkor azt csak olyan szakértelemmel lehet kicserélni, amiből nincs sok az országban, talán az egész világban. Ha pedig komolyabb elektromos kár éri, akkor még ilyen technikával sem lehet megmenteni semmit.
• Külső merevlemezek és USB stick-ek rendszeresen el tudnak romolni! Erről annyi példám van, hogy inkább egyet se említek.

Apropó mit tegyünk, ha mégis rákattintunk arra a linkre, amire nem kéne, és rájövünk, hogy a gépünk fertőzött, és most titkosítja a fájlainkat egy ransomware vírus?

Nagyon egyszerű: azonnal húzzuk ki a gépet a falból. Laptop esetén, ha az aksit nem lehet könnyen eltávolítani, akkor (általában) a bekapcsoló gombot kell 10 másodpercig lenyomva tartani. És NE KAPCSOLJUK BE ÚJBÓL! A fertőzött lemezt ki kell venni, és a menthető adatokat kimenteni úgy, hogy rácsatlakoztatjuk egy "tiszta" gépre. Ehhez persze nem árt a megfelelő szakértelem és eszköz, így ilyen esetben jobb elvinni az egész gépet egy szakemberhez.

És ha bekaptuk, és nincs mentés, akkor utaljuk át a követelt BitCoin-t a megadott címre?

Hát ez jó kérdés. A legtöbb esetben nincs sok értelme, mert aki írta a vírust, ha egyáltalán még ő áll a megadott BitCoin fiók mögött, esze ágában sincs azzal bajlódni, hogy elküldjön neked valamilyen feloldó kulcsot. Ha pedig a vírus úgy van megírva, akkor egyszerűen nem is létezik ilyen kulcs, de ha volt is, az sose került elmentésre sehova.

Ugyan akkor emlékszem egy BBC cikkre, amiben azt írták, hogy egy Amerikai kisváros hivatalát támadta meg egy ilyen vírus pár évvel ezelőtt, és miután az FBI helyreállítási kísérletei kudarcot vallottak, kifizették a kért összeget és megkapták a visszaállítási kulcsot. De gondolom ott nagyobb összegről volt szó, mint amit általában kérnek az ilyen vírusok.

Talán a jövőben fel lehet törni az adott vírust és helyreállítani a titkosított fájlokat?

Erre sajnos nincs sok esély. Az első ilyen vírusok valóban úgy voltak megírva, hogy fix titkosítási kulcsot használtak, amit ha feltörtek, akkor a vírus által titkosított összes fájlt vissza lehetett állítani. Illetve volt, ami nagyon gyenge titkosítási algoritmust használt, amit "brute-force" támadással fel lehetett törni. De ez nem sokáig volt így. A korszerű titkosító vírusok publikus titkosítási algoritmusokat használnak, olyanokat, amiket a bankok is használnak egymás között, és a kulcsot dinamikusan, randomszerűen generálják. Tehát ha sikerül feltörni a titkosított fájljaidat, akkor az nagy problémát jelentene a világnak, mert az azt jelentené, hogy a banki tranzakciók és sok más információs csatorna, ami kritikus a világgazdaság működéséhez, már nem is lenne annyira biztonságos - és ez valószínűleg sokkal nagyobb gondokat okozna neked is, mint az elvesztett fájljaid (személy szerint ilyen esetben elég gyorsan megpróbálnám készpénzben felvenni az összes megtakarításomat!).

Backup up an Express instance of SQL Server

Easy! Follor this tutorial: https://support.microsoft.com/en-us/help/2019698/how-to-schedule-and-automate-backups-of-sql-server-databases-in-sql-se