I have a codebase that I've been keeping on Github that I don't want to worry about losing. I've intermittently backed up all the repos to an S3 instance, but this doesn't feel secure. If my Github and AWS accounts, or just my machine, were compromised then our entire codebase & its backups could be deleted.

What can I do to protect against this? I'm having a difficult time finding solutions which guarantee that I won't have to worry about an account being compromised and everything being subsequently deleted.

  • 2
    I'm not completely sure about your use case but what is the problem with having local backups, i.e. external hard disk, tape etc? Can you please explain your actual requirements in more detail? Commented May 20, 2020 at 16:04
  • 1
    General advice on backups is to use the 3-2-1 rule: three copies, on at least two different media, one of which is offsite. If you use a cloud service for storing backups, enable 2FA. Commented May 20, 2020 at 16:06
  • The standard advice for this is "backups" and "2FA".
    – schroeder
    Commented May 20, 2020 at 16:08
  • @FireQuacker: ... and keep the offsite copy at least 50 km away from your home :) So that in case of earthquake, flooding or similar it remains safe.
    – mentallurg
    Commented May 20, 2020 at 18:18
  • 1
    Send a copy to NSA. They will keep it for you forever. And for free.
    – mentallurg
    Commented May 20, 2020 at 18:22

2 Answers 2


Since you have your code in GitHub, consider creating mirrors at other providers.

Assuming the GitHub repository is the "main" one your work with:

  • GitLab: Create a mirror at GitLab and configure automatic pulling from GitHub. Why is it good? You configure it once, then you can relax, the mirror will be updated automatically.
  • BitBucket: In the free version it supports only automatic pushing, not pulling. Bug look at GitLab again, it can both. Configure automatic pushing from GitLab to BitBucket.
  • DropBox or similar: Create a local copy of your repository in your DropBox folder and periodically pull from the main repository.

Thus effectively you will have your code at 4 different platforms.

  • Also might want to consider using diff email accounts and diff ssh keys such that if one is lost to you, you can still get in with another. Commented Oct 9, 2023 at 15:11

You might want to consider running an SSH server on the machine where the files that need to be backed up are stored (the source machine), then running a cron job on another machine (the backup machine), which connects to the source machine and copies (or rsync's) the files that need to be backed up. You might also want to include a job on the backup machine that preserves changed files for versioning purposes (hard links are good for this).

By allowing connections from the backup machine to the source machine, but not vice-versa - this addresses the security concern that you described in your question. Even if an attacker gains access to your source machine, he would not be able to connect to the backup machine to destroy your backups. Versioning on the backup machine provides another layer of protection, in case backed-up files on the backup machine are overwritten by files copied over from the source machine which had been modified by an attacker. Also, you can make the solution more secure by only allowing SSH connections from the backup machine's IP address, and requiring key-based authentication by the backup machine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .