ForumsHome

Thanks Nat. Please explain what an FTP account is, I have no idea.

Thanks for the tip, computer ameteur here. I'm not necessarily talking about backing up my website.
I just want to back up my computer contents, file, programs, etc.

Xenopod SSH may not be totally secure read their article on Security cautions: http://en.wikipedia.org/wiki/Secure_Shell

I believe that the best way to secure your own data need to be made on your own computer.

For example using an external portable HD to save you data encrypted or protected with passwords to bring it with you anywhere you need to.

I use a 8 gig thumb drive to back up each week. This copy goes home with me so it is there in case the shop goes down. I also burn another thumbdrive once a month that goes to the safe deposit box at my local bank. I save my customer database and cutting patterns so that in a worst case scenario, I can be up and running within a week or less.

Jim

Well it is certainly more secure than just sending out your password as plaintext, and defeating SSH is no easy or practical task.

The easiest way is if you just blindly connect to an SSH server for the first time, because if you just accept the key and don't know that it is the server you should be trusting then you've defeated the point of the encryption.

That problem is easily overcome if you contact your hosting company and ask them what the public ssh key is for your server. Once you know it you can add it to your list of trusted hosts. That way if another server tries to blindly intercept your packets it won't be able to, because SSH clients won't accept connections to servers with the wrong key when you already have a trusted key programmed into the software.

So that leaves what if the malicious server can fake your actual servers credentials. Well this is where it is truly difficult. I would suggest a brief read of the wikipedia articles on public key cryptography or the RSA scheme for a small sense of how it works, but suffice it to say that just because the public key is publically knowable that isn't enough information for a malicious server to compromise your data. While it COULD be enough to fool your ssh client into accepting the connection (though not necessarily since most SSH implementations have several private and public layers all of which would have to have been spoofed for the connection to be accepted) the malicious server still won't be able to read the data you're sending to it. It would need yet another private key from the server it is faking, and getting that is a very difficult task. Basically the only sure method is a brute force approach that is very time and resource intensive (the issue of prime factorization (the math that is involved in this area of security) is what is referred to in computer science as an NP-Hard problem which means no "fast" computational solution exists). Again it is a highly impracticle method.

So why would someone waste so much time and effort on compromising a relatively low priority target? I mean easily that can of effort could be expended on a potentially very rewarding target, but if you're just some blind attacker you always go for the low hanging fruit, because there is enough of it and it is easy to take. Thus again why it is a terrible idea to ever send passwords or any sensitive data over insecure connections.

Hello Xenopod,

I think it depends of what version of SSH server you are talking, all versions are not secure. As far as the FTP account I meant a similar service like this one: http://www.datavaultcorp.com/FTP_Backup/i
ndex.shtml , perhaps I did not explain very well at the first time. Of course a single FTP account will not provide a huge security for sensitive data.

What the big corporations are using these days are VPN connections to secure their data, which provide a decent security.

Anyway, I thing a removable devide should do the job right, it doesn't cost a lot of money and provide plenty of capacity to store sensitive data that you can bring whatever you go.

Dear ampcs,

I too am in hurricane territory. My computer backs up everynight automatically. I use a USB Maxtor drive; it is small and comes with software to manage the back-ups. I set it to backup everynight at 2am. It is very fast (incremental back-ups of files) and does not interfere with my work.

My "plan" is to take the drive with me on evacuations. This may or may not work for you depending on the size of your data.

How much data do you need to back up? Can your business "operate" if you lose power or have to relocate? How will you handle phone calls?

Several years ago I was working in Miami when the hurricanes hit, running a national healthcare distribution center. We received new orders from doctors daily and reorders from customers.

We "relocated" our offices to several new sites since we lost power at our main distribution center.

1) I worked out of my home office in Tampa and had all fax lines forwarded to a send2fax number so that I could manage respond to all incoming faxes from my office.

2) We had phones rerouted a similar way except to numerous cell phones. We had people working out of their homes (those with power) and returning calls from their cells.

3) Inventory was moved to several locations where shipping could still be received from.

It was difficult but we managed through it.