Stories about ransomware attacks fill news headlines regularly, but there is a misconception in the industry about what can be affected by ransomware. While many people think that Linux operating systems are immune to ransomware, I’m here to tell you that ransomware is not limited to Windows operating systems only - it can affect Linux and Mac operating systems as well.
We have warned people about how ransomware affects Linux before, so let’s focus on what you can do to recover your Linux data when affected.
If you are running Linux-based and/or Windows-based servers, Arcserve UDP provides a comprehensive data protection solution to mitigate the impact of data loss or downtime. Linux servers are protected using an agent for physical servers and agentless for virtual servers running on VMware and Hyper-V.
Once protected, Linux data and machines can be recovered by UDP in several ways, including:
- File Level Restore
- Instant Virtual Machine (IVM)
- Virtual Machine (VM) Recovery
- Bare Metal Restore (BMR)
See how quick and easy it is to recover Linux data and machines below.
Linux File Level Restore
Recovering data via File Level Restore works for both agent- and agentless-based backups and is simple to initiate from the console. Start the wizard by right clicking a server and selecting restore, then choose the recovery point and select the data to restore and where you want to restore to, which can be either the original or an alternative location.
You’re back up and running in no time.
Instant Virtual Machine (IVM)
IVM is the process whereby UDP starts a machine directly from the backup image to either VMware or Hyper-V, providing an instant recovery of your server. IVM can also be used for testing purposes such as UDP Assured Recovery Testing. IVM is cross hyper-visor which means an agentless backup of a Hyper-V virtual machine can be started as a VMware virtual machine.
To start an IVM, select the machine, right click and select instant VM from the drop down. You will be presented with a wizard to select what hyper-visor, recovery point and resources options you would like to choose.
In the resource options, you will define what temporary location to use to store the changes (for VMware this is a datastore location, for Hyper-V this is a folder location). You can add your network adaptor and select what virtual network you want to use, and alternatively you can update the DNS server with the new information.
To make the IVM permanent, simply use storage vMotion in VMware or move the machine in Hyper-V to migrate the disks from the backup to the hyper-visor. And just like that, you’re back up and running.
In the case of a Linux VM that is affected by ransomware or other malicious software, you can recover the Linux virtual machines directly back into the hyper-visor itself.
Right click the server you want to restore and select restore VM.
This will start the wizard to recover the entire VM back into the hyper-visor.
During the recovery, you can track the progress of the VM recovery or check the logs of the restore for more details. Then you can sit back and relax – you’re back up and running.
Bare Metal Restore (BMR)
BMR is the process in which a backup image is entirely restored back to physical hardware, and the hardware may be different from the original source. During an outage, Arcserve UDP can enhance the DR of your physical hardware.
For example, if your physical server has crashed and you need to order a new server, you can keep the RTO low by starting an IVM. In this situation, users can keep working on the server or application while you order the new hardware. Once the new hardware is installed, you can start the BMR process, but instead of recovering from the backup, you choose to recover from a virtual machine and select the IVM as your recovery option. This IVM does need to be switched off during the BMR process, so plan this changeover accordingly outside of normal business hours. And plan to be back up and running in a flash.
By Harold Buter
Arcserve Pre Sales Consultant
UK South, Nordics & Netherlands