How to configure MikroTik for a small business: a secure baseline step by step
Update RouterOS, replace the admin user, close management services, set up the firewall and a guest network — with ready-to-use commands.
Read articlerestic is a free, open-source backup tool that encrypts everything before it leaves the server, stores only changed data and can send backups to a NAS over SFTP, to S3-compatible object storage and other destinations. It is a good fit for web, file and application servers.
Before you start: you need a backup destination — here an SFTP account
backup on a NAS at 192.168.88.20 with SSH key login. Store the repository password safely outside the server (for example in your password manager): without it, the backups cannot be restored. For database servers, dump the database to a file before the backup (for example with pg_dump or mysqldump).Step 1. Install restic and create the repository
Generate a random password, save a copy in your password manager and initialise the encrypted repository.
sudo apt install restic
sudo sh -c 'openssl rand -base64 32 > /root/.restic-pass && chmod 600 /root/.restic-pass'
export RESTIC_PASSWORD_FILE=/root/.restic-pass
export RESTIC_REPOSITORY=sftp:backup@192.168.88.20:/volume1/restic/web01
restic initStep 2. Run the first backup
Back up configuration, website files and home directories. Adjust the paths to what matters on your server.
restic backup /etc /var/www /home --exclude-caches
restic snapshotsStep 3. Set the retention policy and check the repository
Keep 7 daily, 4 weekly and 6 monthly snapshots and remove older ones. restic check verifies that the repository is consistent.
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune
restic checkStep 4. Automate it
Create a script and run it every night with cron. Add monitoring so you are alerted when the backup fails or the log stops updating.
#!/bin/sh
# /usr/local/bin/backup.sh
export RESTIC_PASSWORD_FILE=/root/.restic-pass
export RESTIC_REPOSITORY=sftp:backup@192.168.88.20:/volume1/restic/web01
restic backup /etc /var/www /home --exclude-caches || exit 1
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune
# /etc/cron.d/backup
30 2 * * * root /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1Step 5. Test a restore
A backup is only proven by a restore. Restore the latest snapshot to a test folder at least once a month and open a few files.
restic restore latest --target /tmp/restore-test
ls /tmp/restore-testMake it ransomware-resistant
- Use a separate backup account that only the backup server can reach.
- Protect the destination with snapshots that cannot be deleted from the server (for example immutable snapshots on the NAS, or object lock in cloud storage).
- Keep one copy outside the office — the 3-2-1 rule.
The best backup tool is the one that runs every night and has been restored at least once.
Need help with this? Contact CySec for a free consultation.