content: Simple Concepts for creating a hardened offline backup system [Avoid Ransomware] I recommend ARCH Linux, compile it yourself. But these concepts will apply to any server:  (Keeping it terse, just nutshells) Purpose: Scope: Overview: The server shall be connected behind a hardware firewall outside of your own DMZ. It should be configured to accept NO incoming connections, except during pre-scheduled time intervals, and only then from only specific, private IP addresses. On Debian this would look something like using iptables, firewalld or some other firewall which has builtin time features, or simply use cron or atd to enable/disable certain firewall rules according to schedule. The server reaches out and uses rsync or scp or whatever your backup method is preffered. You can use a DMZ based backup server to collect all the backups from various public facing systems, but it is only stored temporarily. When the "Offline" backup server pulls the data from the DMZ "Primary" backup server, it is then scrubbed or simply deleted off the Primary. The "Offline" server stores some data in a write-once optical device, and other data on typical removable or external hard disks or NAS devices which are physically locked in a separate facility on a scheduled basis. The Tips: Following this very simple, high level design, you can ensure that your data doesn't fall prey to a 'Ransomware' attacker that got into your backup server. It's not hard, but the media sure does have some silly ideas about how things work. And it seems that so do some of our local and State Governments. I guess that's what you get with an education system like we have, but I digress..