Re: [BackupPC-users] Backups are performed but are empty

[G.W. H. <ba...@ju...>]

Hi there,

On Thu, 13 Nov 2025, J?rg Ehrchen wrote:
> ...
> It was indeed due to the missing rsync client path.  I saved it with
> the correct entry in the config, initiated a backup, and it is
> working as it should. :)

:)

> Now I just have to figure out, why the rsync client path was deleted
> from the config files.  It definitely wasn't me.

I hope I'm wrong, but...

That's rather worrying.  To my eyes, the change looks very much more
like an intentional edit than some side-effect of a process going off
the reservation and writing random rubbish to random files.  So I have
to wonder if it was deliberate and unauthorized.

Assuming that you'd have told us if anyone else had the ability (and
permission) to make such a change, to me this smells like ransomware.

For obvious reasons, the first things that an attacker will do if he's
any good (and some of them are *very* good) will be to kill your virus
detection and clobber your backups.  Scrambling all your files isn't
much use to him if you can just recover them from your backups.

If I were you I'd want to make sure that my backup server wasn't under
attack.  My Windows boxes would be amongst the first suspects.  If I
had Windows boxes on the same network segment as my backup server they
would not be allowed to make changes to the backup configuration, nor
would they be allowed to delete backups.  There's a case for copying
the backup pool to offline storage - after verifying that it's good.

-- 

73,
Ged.