Mohammed Shareek

About This Project

Designed and built the lab's complete backup system from zero, following the 3-2-1 principle, with ransomware resistance and verified restore integrity.

What Was Built

• A dedicated physical backup server, deliberately kept independent from the virtualisation cluster it protects
• Two datastores on two separate NAS systems, kept in step by a scheduled pull synchronisation job
• Deduplicated, incremental backups of all 11 virtual machines and containers, plus file-level backups of a physical Linux host through the backup client and a systemd timer
• Server-side retention, garbage collection, and a weekly verification job that re-reads snapshots and confirms they are actually restorable

Ransomware Resistance

The cluster authenticates to the backup server with a scoped API token that can write backups but cannot delete or prune them. Deletion is only possible from the backup server itself, so an attacker with cluster access cannot destroy the backups. The synchronisation job to the second NAS never removes files that vanished at the source, keeping the second copy independent.

Performance Investigation

Initial backups ran at around 2 MiB/s and large VMs timed out. I isolated the cause by testing each layer separately — raw network throughput measured close to gigabit line rate, and sequential storage writes were healthy, but synchronous 4K writes collapsed to about 100 kB/s. The root cause was ZFS synchronous write handling without a dedicated log device, combined with a backup engine that forces sync writes per chunk. After changing the write behaviour on that dataset — an accepted, documented risk limited to in-flight backup data, and covered by the second copy plus verification — throughput rose to about 72 MiB/s, roughly 35 times faster, and all backups completed.

Along the way I also found a switch port that had trained at 100 Mbit instead of gigabit despite both sides advertising correctly, and fixed it by replacing the patch cable.

Skills Demonstrated

• Backup architecture and 3-2-1 strategy
• Least-privilege access design
• ZFS and NFS storage behaviour
• Structured bottleneck analysis
• Restore verification