3-2-1 rule

Three copies of the data, on two different kinds of media, one of them off-site — and the count is the least interesting part. The clause that does the work is the last one: an off-site copy the server itself can neither write to nor erase. A second copy under /var/backups on the same machine protects against a careless rm and nothing else. It dies with the disk, with the provider's fire, and first of all with ransomware, which encrypts whatever it finds mounted. Root on the server must not amount to root on the archives. Two arrangements hold: the backup machine pulls the data — it connects to the server, never the reverse — or the remote storage enforces an immutability or time lock the server cannot lift. Three copies the server can delete are one copy.