Network-attached backups that use standard read-write credentials are vulnerable to ransomware encrypting both source and destination simultaneously. True resilience demands append-only, immutable ZFS replication.
This operational guide details how to build an automated, pull-based snapshot replication pipeline using Sanoid and Syncoid over restricted SSH keys.
⚡ Quick Runbook: 60-Second Implementation
TL;DR: Copy and deploy the baseline production definition directly onto your host:
# Create unprivileged backup user
sudo useradd -m -s /bin/bash zfsbackup
# Grant read-only snapshot send permissions
sudo zfs allow zfsbackup send,snapshot,hold fastpool/databases1. The Pull-Based Replication Architecture
Security Rule: The production host should never have write or root credentials to the backup host. Instead, the dedicated backup server initiates the SSH connection to pull snapshots from the production node using a restricted, read-only ZFS user.
2. Configuring Restricted ZFS Delegation
On the production server, delegate specific non-destructive ZFS permissions to an unprivileged SSH user:
# Create unprivileged backup user
sudo useradd -m -s /bin/bash zfsbackup
# Grant read-only snapshot send permissions
sudo zfs allow zfsbackup send,snapshot,hold fastpool/databases3. Automating Replication with Syncoid
On the destination backup server, run Syncoid via an hourly systemd timer:
# Execute differential snapshot transfer
syncoid --no-privilege-elevation --sshport=22 [email protected]:fastpool/databases backuppool/prod-node01-databases