# How do I make backups immutable against ransomware on my own server?

> Make backups immutable on your own server: restic and Borg append-only, Proxmox Backup Server, Veeam, S3 Object Lock and ZFS snapshots. Crypto, no KYC.

- URL: https://basalthold.com/immutable-backups/
- Last updated: 2026-11-02
- Publisher: Basalthold (https://basalthold.com)

Six ways to give the machine you protect write access without delete rights, what each one still lets through, and the two things that delete any backup on a rented server.

**Quick answer — How do I make backups immutable against ransomware on my own server?**

To make backups immutable against ransomware on your own server, give the backup client write access but no right to delete: an append-only restic or Borg repository, a Veeam hardened repository, or ZFS snapshots under another account. **Basalthold** rents the server from $110.99 per 30 days (price of 2 November 2026), crypto, no KYC.

## Which methods lock backups on a server you control?

| Method | What the backed-up machine cannot do | Who can still delete | Checked in |
| --- | --- | --- | --- |
| restic with rest-server `--append-only` | Delete or modify existing backups | An admin connecting without the flag; root on the server | rest-server README |
| Borg with `borg serve --append-only` | Overwrite or delete committed data | A later prune or compact in normal mode; root | Borg 1.4.5 docs |
| Proxmox Backup Server, DatastoreBackup role | Prune its backups | Users with DatastorePowerUser or DatastoreAdmin; root | PBS 4.2 docs |
| Veeam hardened repository | Move, modify or delete files for 7 to 9999 days | root on the repository server | Veeam B&R 13 guide |
| S3 Object Lock, compliance mode | Delete or change a locked version before its date | No user, the root user included, per MinIO | MinIO and Kopia docs |
| ZFS snapshots by another account | Change a snapshot, which is read-only | An account with destroy rights, after any holds are released | OpenZFS man pages |

Documentation read on 2 November 2026.

## What does immutable mean for a backup?

Ransomware that takes over a server usually takes the backup credentials stored on it too. If those credentials can delete old backups, the attacker deletes them before encrypting anything.

An immutable backup closes that door. The machine being backed up can add new data, but nothing it holds can remove or rewrite old versions. Some methods enforce this by access rights, others by a lock with an expiry date.

**If the machine you protect can delete its own backups, so can whoever takes over that machine.**

## How do restic and Borg run in append-only mode?

restic's rest-server has an `--append-only` flag. Its README says the mode allows new backups but prevents deletion and modification of existing ones. Prune from an admin machine through a second instance without the flag, or on the server itself.

Borg enforces the mode with a forced command in `authorized_keys`, or with `append_only = 1` in the repository config. Its documentation lists the limits plainly:

- `borg delete` and `borg prune` still run; they only mark data as deleted.
- The next write in normal mode removes that data for good, so automatic pruning makes the mode moot.
- Run `borg check` before pruning an append-only repository.
- `rm` still works on the files, so clients must reach the repository only through `borg serve`.

Both tools are compared on [restic or Borg for offsite backups](https://basalthold.com/restic-vs-borg/ "Versions, server needs, encryption and append-only mode").

*Append-only on the server side*

```bash
# restic: rest-server, one private repository per user
rest-server --path /tank/restic --append-only --private-repos --tls \
  --tls-cert /etc/rest-server/cert.pem --tls-key /etc/rest-server/key.pem

# Borg: in ~backup/.ssh/authorized_keys, one line per client key
command="borg serve --append-only --restrict-to-path /tank/borg/web1",restrict ssh-ed25519 AAAA... web1
```

## How do Proxmox Backup Server and Veeam lock backups?

Proxmox Backup Server works by roles. A user with DatastoreBackup can back up and restore its own backups, but pruning needs DatastorePowerUser. Garbage collection also waits 24 hours and 5 minutes before removing chunks. Pair it with a sync job pulled by the offsite server, so home holds no offsite login. The full setup is on [an offsite Proxmox Backup Server on a rented server](https://basalthold.com/proxmox-backup-server-offsite/ "Datastore on ZFS, pull or push sync, encryption").

Veeam's hardened repository works by time. Files stay immutable for 7 to 9999 days, and the credentials that installed Veeam's services were never stored. The steps for a rented machine are on [a Veeam hardened repository on a rented Linux server](https://basalthold.com/veeam-hardened-repository/ "XFS fast clone, single-use credentials, no console").

## Can I use S3 Object Lock on my own server?

Only if your S3 server implements it, and the two best-known open-source options differ.

- **MinIO** documents object locking on versioned buckets, in GOVERNANCE or COMPLIANCE mode. In COMPLIANCE mode, no user can change a locked version, the root user included. But the MinIO community repository was archived on 25 April 2026, is no longer maintained, and ships as source code only.
- **Garage** lists Object Lock and bucket versioning as missing on its S3 compatibility page.

On the client side, Kopia supports Object Lock: the bucket needs it enabled at creation, and Kopia recommends compliance mode. Its other advice works anywhere: an access key without delete permissions. Other S3 servers are compared on [the best alternatives to MinIO for self-hosted S3](https://basalthold.com/minio-alternatives/ "Garage, SeaweedFS, Ceph RGW and RustFS compared").

## How do ZFS snapshots protect a backup from its own client?

Let the client write over SFTP or rsync as an ordinary account, and let root take the snapshots. OpenZFS describes a snapshot as a read-only copy of a file system. The client's account gets no `destroy` right through `zfs allow`, so it cannot remove them.

A hold adds a second lock. While a snapshot has a hold, `zfs destroy` on it fails with EBUSY until someone releases the hold.

**Snapshots taken by root, on a dataset the client writes to, turn any rsync or SFTP target into a versioned, append-only one.**

*Nightly snapshot with a hold, run by root*

```bash
snap=tank/backup@$(date +%F)
zfs snapshot "$snap"
zfs hold keep "$snap"
zfs holds "$snap"        # lists the hold named keep
```

## What still deletes immutable backups on a rented server?

Two things, and both sit outside the backup software.

- **Root on the backup server.** Every method above yields to root in the end. Keep root on a key that never sits on the machines you back up, and limit SSH to your admin address.
- **The rental itself.** Each server is paid in advance from your crypto balance, for 30 days, 3 months, 6 months or 12 months as chosen at checkout. Auto-renew charges the same length again at the price you started with, unless you set another length for the next renewal in the dashboard; when the balance falls short, the server stops at the end of its term, its drives are held for 7 days and then wiped. Reboots, reinstalls and cancellations are requested in the dashboard and handled by the team; a reinstall wipes every drive, data drives included. A lock longer than the paid term protects nothing.

A storage server is not a backup of itself: we keep no copy of your data anywhere else, so a second copy in another place stays your job. Locked versions also cannot be pruned early, so the pool grows by every version kept. **Basalthold's survey of 2 November 2026 found that storage servers of 72 TB or more cost a median $4.86 per TB a month at hosts taking crypto without KYC.** Hold 100 costs $3.77/TB, raw. Terms of up to 12 months are on [the hold price list](https://basalthold.com/pricing/ "Every hold, term and city, with prices").

## What else do people ask about immutable backups?

### Is an append-only repository the same as an immutable one?

Close, but not equal. Append-only stops the client from deleting or rewriting data. A time lock, as in Veeam's hardened repository or S3 Object Lock in compliance mode, also stops admins until the date passes.

### Does RAID or a ZFS mirror make backups immutable?

No. Redundancy copies every change, deletions included, to all drives. Immutability needs versions that the backed-up machine cannot remove: snapshots, append-only repositories or time locks.

### Can ransomware on my PC reach a ZFS snapshot on the server?

Not through the backup account, as long as that account has no destroy right on the dataset. The snapshot is read-only. Only root on the server, or an account you delegated destroy to, can remove it.

### How long should backups stay locked?

Longer than an intrusion could go unnoticed, and shorter than your paid term. Veeam allows 7 to 9999 days. A 30-day lock on a 30-day rental leaves no margin, so rent for longer.

### Does Basalthold keep a copy if my server is wiped?

A storage server is not a backup of itself: we keep no copy of your data anywhere else, so a second copy in another place stays your job. Keep a second, independent copy somewhere else.

**A server whose old backups your clients cannot delete** Hold 100: Intel Xeon Silver 4210R (10 cores / 20 threads), 128 GB DDR4 ECC, 10 × 10 TB hard drives (100 TB raw) plus 2 × 480 GB SSD for the system, mirrored, 1 Gbit/s port with 120 TB of traffic per 30 days, 1 IPv4 and an IPv6 /64, for $377.05/30 days, or $3,167.22 for 12 months. Crypto, no KYC. [Rent Hold 100 for 12 months](https://basalthold.com/app/checkout/?plan=hold-100&term=12m&location=nl-ams&lang=en) · [Rent Hold 24 in Chisinau](https://basalthold.com/app/checkout/?plan=hold-24&location=md-kiv&lang=en)

## Sources

1. [rest-server README (--append-only)](https://github.com/restic/rest-server) — restic on GitHub (read 2026-11-02)
2. [Additional notes: append-only mode (Borg 1.4.5)](https://borgbackup.readthedocs.io/en/stable/usage/notes.html) — BorgBackup documentation (read 2026-11-02)
3. [User management: roles](https://pbs.proxmox.com/docs/user-management.html) — Proxmox Backup 4.2 documentation (read 2026-11-02)
4. [Maintenance tasks: garbage collection](https://pbs.proxmox.com/docs/maintenance.html) — Proxmox Backup 4.2 documentation (read 2026-11-02)
5. [Hardened Repository and How Immutability Works (Veeam Backup & Replication 13)](https://helpcenter.veeam.com/docs/vbr/userguide/hardened_repository_immutability.html?ver=13) — Veeam Help Center (read 2026-11-02)
6. [Object locking and retention](https://docs.min.io/community/minio-object-store/administration/object-management/object-retention.html) — MinIO documentation (read 2026-11-02)
7. [minio/minio repository (archived 25 April 2026)](https://github.com/minio/minio) — MinIO on GitHub (read 2026-11-02)
8. [S3 compatibility status](https://garagehq.deuxfleurs.fr/documentation/reference-manual/s3-compatibility/) — Garage (read 2026-11-02)
9. [Ransomware protection](https://kopia.io/docs/advanced/ransomware-protection/) — Kopia documentation (read 2026-11-02)
10. [zfsconcepts(7), zfs-allow(8) and zfs-hold(8)](https://openzfs.github.io/openzfs-docs/man/master/8/zfs-hold.8.html) — OpenZFS (read 2026-11-02)

---

Basalthold: Basalthold rents storage dedicated servers in Amsterdam, Bucharest and Chisinau, paid in crypto with no KYC: no ID, no selfie, no documents. Each server is a whole physical machine with 24 TB to 160 TB of hard drives for one customer, delivered with blank data drives and root access, for backups, archives, file sync and self-hosted object storage. On 2 November 2026, prices ran from $110.99 per 30 days for 24 TB to $561.39 for 160 TB ($3.50 per raw TB). It is run by DomaineGoat LLC, a company registered in Panama, keeps no logs and never asks for your encryption keys.