pinkpixel-dev/implementing-immutable-backup-with-restic
SKILLS/implementing-immutable-backup-with-restic/SKILL.md
Implements immutable backup strategy using restic with S3-compatible storage and object lock for ransomware-resistant data protection. Automates backup creation, integrity verification via restic check --read-data, snapshot retention policy enforcement, and restore testing. Integrates with AWS S3 Object Lock, MinIO, and Backblaze B2 for WORM (Write Once Read Many) storage that prevents backup deletion or encryption by ransomware actors.
$ install --global
skillsauthnpx skillsauth add pinkpixel-dev/skills-collection-2 implementing-immutable-backup-with-resticInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 13, 2026, 4:36 AM162.6s3 files scanned
SKILL.md
- name:
- implementing-immutable-backup-with-restic
- description:
- >
- domain:
- cybersecurity
- subdomain:
- ransomware-defense
- tags:
- [restic, backup, immutable, ransomware, s3, object-lock, worm, recovery]
- version:
- 1.0.0
- author:
- mahipal
- license:
- Apache-2.0
Implementing Immutable Backup with Restic
When to Use
- Establishing ransomware-resistant backup infrastructure with cryptographic integrity verification
- Implementing 3-2-1-1-0 backup strategy where the extra 1 is an immutable copy
- Automating backup verification workflows that test restore capability on a schedule
- Protecting backup repositories from deletion or modification by compromised admin accounts
- Meeting compliance requirements for data retention with tamper-proof storage
Do not use as the sole backup solution without also maintaining offline/air-gapped copies. Object lock protects against logical deletion but not physical storage failure.
Prerequisites
- restic binary installed (https://restic.readthedocs.io/)
- S3-compatible storage with Object Lock enabled (AWS S3, MinIO, Backblaze B2)
- Python 3.8+ with subprocess module
- AWS CLI or MinIO client (mc) configured for bucket access
- Sufficient storage for backup repository (typically 2-3x source data with deduplication)
Workflow
Step 1: Initialize Restic Repository with Encryption
Create an encrypted restic repository on S3-compatible storage with object lock enabled. Restic uses AES-256-CTR for encryption with Poly1305-AES for authentication, ensuring backup data is both confidential and tamper-evident.
Step 2: Configure Object Lock Retention
Enable S3 Object Lock in Compliance mode on the backup bucket to prevent any principal (including root) from deleting or modifying objects during the retention period. Set retention to match your backup window requirements (typically 30-90 days).
Step 3: Automate Backup and Verification
Schedule backup operations with post-backup integrity verification using restic check --read-data which downloads and verifies every data blob against its stored checksum. Log results and alert on any integrity failures.
Step 4: Test Restore Procedures
Periodically restore random files from backup snapshots to a temporary location and compare checksums against the original to validate end-to-end backup integrity. Document restore times for RTO planning.
Key Concepts
| Term | Definition | |------|------------| | Object Lock | S3 feature that prevents object deletion or overwrite for a specified retention period | | Compliance Mode | Object Lock mode where even the root account cannot delete objects before retention expires | | Deduplication | Restic stores data in content-addressable chunks, deduplicating across all snapshots | | 3-2-1-1-0 | 3 copies, 2 media types, 1 offsite, 1 immutable, 0 errors in verification |
Tools & Systems
- restic: Fast, secure, cross-platform backup tool with built-in encryption and deduplication
- resticpy: Python wrapper for restic CLI operations
- AWS S3 Object Lock: WORM storage for tamper-proof backup retention
- MinIO: Self-hosted S3-compatible storage with Object Lock support
Output Format
BACKUP VERIFICATION REPORT
===========================
Repository: s3:s3.amazonaws.com/company-backups-immutable
Snapshots: 45
Total Size: 2.3 TiB (deduplicated from 8.7 TiB)
Last Backup: 2026-03-11T02:00:00Z
Integrity Check: PASSED (all packs verified)
Object Lock: Compliance mode, 90-day retention
Restore Test: PASSED (15 files verified)
Related Skills
pinkpixel-dev/performing-lateral-movement-with-wmiexec
tools
VerifiedTrustedCommunity
Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.
1SKILL.mdUpdated Aug 9, 2026
pinkpixel-dev/performing-lateral-movement-detection
data-ai
VerifiedTrustedCommunity
Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques.
1SKILL.mdUpdated Aug 9, 2026
pinkpixel-dev/performing-kubernetes-penetration-testing
tools
VerifiedTrustedCommunity
Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools
1SKILL.mdUpdated Aug 9, 2026
pinkpixel-dev/performing-kubernetes-etcd-security-assessment
testing
VerifiedTrustedCommunity
Assess the security posture of Kubernetes etcd clusters by evaluating encryption at rest, TLS configuration, access controls, backup encryption, and network isolation.
1SKILL.mdUpdated Aug 9, 2026