The off-site copy

1. Introduction

What the service does

WFP (Web File) of Esapanel is a space outside your premises where your NAS, your servers and your PCs send their backups and the copies of their files, with the programs you already use: Synology Hyper Backup, QNAP Hybrid Backup Sync, Duplicati, the Backup Manager of Plesk, rsync, FileZilla, WinSCP.

The panel does more than receive the files: it watches that the copies arrive. It tells you when each device last uploaded, alerts you when one stops uploading and composes every week and every month a report with the days the copies arrived, also as a support for the documentation of the security measures required by the NIS2 directive.

WFP is a destination for copies, not a network drive: it is not mounted as a drive on the PCs and does not replace the NAS of the office.

Who this guide is for

The IT staff of the company, or the supplier that manages its systems. You need to know how a backup job is set up on a NAS or a server; you do not need to know Esapanel.

What you need

An active WFP subscription.
A user of the panel that can open the pages of the subscription.
Administrative access to the devices and the programs to connect.
The devices must be able to go out to the Internet toward the server of the copies, on the ports listed in chapter 3. No inbound port has to be opened in your network.

In this guide the names are examples (copies.example.com, ab12c-nas). The real values of your subscription are in the pages of the panel.

2. The pages of the subscription

Open the subscription in the panel (Services › Subscriptions, then your subscription). The off-site copy has five tiles:

Tile	What it holds
Off-site copy	The space of the plan, the space used, the server and the ports to connect to
Accounts	The devices, the programs and the people that send their copies, with the instructions to connect them
Shared folders	Folders of the subscription that the accounts you choose see together
Activity	When each account connected and how much it uploaded and downloaded
Reports	The weekly and monthly reports of the copies arrived

In every page the ? at the top right opens the description of the page.

3. The space and where to connect

The page Off-site copy shows:

Code: five letters and digits given by the panel, the same for the whole life of the subscription. The names of the accounts begin with the code: if the code is ab12c, the account nas signs in as ab12c-nas.
Space of the plan and Space used: the space used is measured every hour.
Accounts of the plan and Shared folders of the plan: how many the plan allows.
Where to connect: the name of the Server and the port of each protocol.

Protocol	Who uses it	Usual port
rsync (SSH)	Synology Hyper Backup, Linux servers	60022
SFTP	Duplicati, WinSCP, FileZilla	50022
FTPS	The Backup Manager of Plesk, FileZilla	21, with the passive ports 40000–40999
WebDAV (HTTPS)	QNAP Hybrid Backup Sync	443

The real ports are those written in the page. If your firewall filters the outgoing traffic, open toward the server only the ports of the protocols you use; FTPS also needs the passive ports.

Plain FTP is never accepted: every connection is encrypted.

4. Adding an account

Every device, program or person that sends copies has an account: its folder on the server, its password or its SSH keys, the protocols it may use. An account does not sign in to the panel: it only sends and reads back the files. Give each device its own account, so you always know who uploaded and can stop one without touching the others.

Open the tile Accounts and press Add account.
What sends the copies? Choose the program: Synology Hyper Backup, QNAP Hybrid Backup Sync, Duplicati, Plesk, rsync on Linux, FileZilla, WinSCP, or Another program. The choice sets the kind and the protocols the account starts with and, afterwards, the instructions.
Name: lowercase letters, digits and dashes, for example nas. The programs sign in with the full name, ab12c-nas.
Description: optional, to recognize it ("NAS of the office").
Kind: Device or program, or Person for who uploads by hand.
Protocols: leave on only those the program needs. Each protocol is a door into the folder.
SSH public keys: optional, for rsync and SFTP, one per line. The account signs in with its password as well.
Press Create the account.

The panel shows the password of the account. Copy it into the program at once: it is shown only this time. If it is lost, give the account a new password (chapter 7).

Below the password you find How to connect: the steps for the program chosen and The values to type, already filled in (server, port, username, folder). With Instructions for you can read the instructions of another program.

5. Connecting the programs

The complete instructions, with the values of your account, are in the page of the account. Here are the essential points.

Synology Hyper Backup

In Hyper Backup create a new data backup task and choose rsync as the destination.
Server type: rsync-compatible server. Server name, port, username and password: those of the page of the account. Turn on the transfer encryption.
Backup module: backup. Directory: a name of your choice, the folder of this task.
Both the multi-version and the single-version backup work; with the multi-version one turn on the client-side encryption.

QNAP Hybrid Backup Sync

In Hybrid Backup Sync open Storage Spaces, create a new one and choose WebDAV.
Server URL: the Address (WebDAV) of the page of the account, in HTTPS; username and password of the account.
Create a backup job toward that storage space, with a folder of your choice.
Keep the versions on and turn on the client-side encryption.

Toward an rsync server Hybrid Backup Sync only makes sync jobs, without versions: for a real backup use WebDAV.

Duplicati

Add a backup; as the destination choose SFTP (SSH).
Server, port, username and password of the account. Path on the server: / or a subfolder, for example /office-pc.
Test the connection and accept the key of the server only if it is one of those shown in the page of the account (Keys of the server).
Keep the AES-256 encryption with a passphrase of your own.

Plesk

In Plesk open Tools & Settings › Backup Manager › Remote Storage Settings › FTP (for the whole server), or the Backup Manager of a subscription.
FTP server hostname, username and password of the account. Directory for the backup files: /.
Turn on the passive mode and FTPS.
Turn on the password protection of the backups.

Plesk leaves a file .ftpaccess in the folder: that is normal, and the server ignores it.

rsync on Linux

Put the public key of the user that runs rsync among the SSH keys of the account, or use the password.
Send with rsync over SSH to the port of rsync, into the Folder (rsync) of the account, which is an absolute path. For example:

rsync -a -e "ssh -p 60022" /path/of/the/backups/ ab12c-nas@copies.example.com:/srv/wfp/ds1/ab12c/accounts/ab12c-nas/

The options --inplace and --append are refused: every file arrives as a new file, and an interrupted copy does not spoil the one before.

FileZilla and WinSCP

For who uploads by hand. In SFTP use the port of SFTP and accept the key of the server only if it is one of those of the page of the account. In FileZilla you can also use FTP with "Require explicit FTP over TLS" on the port of FTPS. In SFTP and FTPS the folder is /: the account sees only its own.

Another program

Any program that sends in SFTP, in FTPS (explicit TLS, passive mode), in rsync over SSH or in WebDAV can use an account, with the values of its page.

6. Encrypting the copies

Always turn on the encryption of the program (Hyper Backup, Hybrid Backup Sync, Duplicati, Plesk), with a password kept outside the device and outside the server of the copies.

This way the copies can be read only by you: who runs the server keeps data it cannot read. Mind the other side of it: without that password nobody, not even us, can restore the copies.

7. Managing an account

In the tile Accounts the list shows for each account its kind, its protocols, its Last upload and its state. Open an account to:

Protocols and keys: change the description, the protocols, the SSH keys and the alerts (chapter 9).
New password: the panel generates a new one and shows it once. The programs that use the old one no longer sign in until you give them the new one.
Suspend: the account no longer signs in with any protocol and its sessions end at once; the files stay. Reactivate lets it in again.
Remove: the account and all the files of its folder are removed for good. There is no way back.

The states of an account: Active, Suspended, Being prepared, Not ready (the server did not accept the account: open it and press Try again).

If a device is compromised or retired, suspend its account at once: the others go on working.

8. Shared folders

A shared folder belongs to the subscription, not to an account. The accounts you choose find it as a folder inside their own, and a file uploaded by one can be read and changed by the others. It serves, for example, several people who leave documents in the same place.

Open the tile Shared folders and press Add a shared folder.
Name: the accounts see a folder with this name inside their own.
Accounts that see it: choose the accounts.

Rules:

Only accounts with SFTP or FTPS, and without rsync, see it. An account that uses rsync cannot see a shared folder, and an account that sees one cannot turn rsync on.
Shared folders are not seen in WebDAV and in rsync.
An account added sees it at its next connection; an account taken out loses it at once.
Remove deletes the shared folder and all its files, for every account.
The space of a shared folder counts in the space of the subscription.

9. Checking that the copies arrive

Last upload

In the list of the accounts, Last upload is the end of the last session in which the account uploaded at least one file. An account that has not uploaded yet shows Never.

The alerts

In the page of the account, in Protocols and keys:

Alert if it does not upload for: 12 hours, 1, 2, 3 or 7 days. Once that time has passed since the last upload you receive one alert by email, and in the list the account is marked Late; when it uploads again you receive the notice that it is back. An account of the kind Device or program starts with the alert on at 1 day; one of the kind Person without it. Choose a time a little longer than the interval of your backups: 1 day for a nightly backup, 7 days for a weekly one.
Alert if the copy is much smaller than usual: off by default. It tells you when a session uploads less than half of what the account usually uploads: the case of a backup that arrives, but incomplete.

An account just created does not alert until it has uploaded for the first time. While the subscription is suspended the alerts are suspended.

The activity

The tile Activity lists the sessions: a row is everything an account does in one protocol, until it stays an hour without doing anything. For each session you see the account, the protocol, the address it connected from, the start and the end, the files and the space uploaded and downloaded. The backup of a NAS is usually one session with many files.

Under way: the hour of silence has not passed yet, and the numbers still grow.
Refused or failed: an upload interrupted, a file refused because the space is over the limit, a command not allowed. A session with only this number and nothing uploaded deserves a check on the device.

The single files are not listed. The plan says for how many days the sessions are kept.

10. The reports

The tile Reports holds a report for every week (composed on Monday) and one for every month (composed on the first). When a report is ready you receive an email with the link.

A report says, for each account:

the days with a copy: how many days of the period, and which ones, saw at least one file arrive;
the files and the space uploaded;
the last upload.

The totals and the space used follow. Open a report to read it and press Print or save as PDF to keep it.

A report never changes once composed: the fingerprint at its end attests that the data are those of the day it was made. The reports are kept as many days as the plan keeps the activity.

In Your choices you decide which reports you want (weekly, monthly).

A report proves that the copies arrive, not that they can be restored. That is checked only with a restore test from the device or the program: do one periodically.

11. When the space runs out

When the space used goes over the Space of the plan, the accounts become read only: they read and delete, but do not upload. You receive an alert by email, and the pages show it in red.

An upload already started ends; the next ones are refused.
The backup programs report an error, often a generic one: Hyper Backup only writes "Failed to run backup task". If a backup fails without a clear reason, look at the space first.
To upload again free some space (reduce the number of versions the program keeps, or delete old copies) or ask for more space. The space is measured again every hour: when it is back within the limit the read only is lifted by itself, and you receive a notice.

Before the limit the panel alerts you when the space passes the warning threshold of the plan.

12. Subscription suspended or deleted

Suspended or disabled: the accounts are blocked and do not sign in; the files stay. When the subscription is active again the accounts work again, with the same passwords.
Deleted: the files are kept 30 days, then removed for good.

13. Common problems

What happens	What to check
The program does not connect	Server and port of the page Off-site copy; that your firewall lets the traffic out toward that port; for FTPS the passive ports too
"Access denied"	The full username, with the code (`ab12c-nas`); the password, shown only at the creation: when in doubt New password; that the account is not Suspended and has that protocol on
The program asks whether to trust the server	Compare the key with the Keys of the server in the page of the account, and go on only if it is one of those
After many wrong attempts it no longer connects even with the right password	The server blocks for a while the addresses that fail repeatedly: wait, or ask the support to unblock your address
The backup fails without a clear reason	The space: over the limit the accounts are read only (chapter 11)
An interrupted FTPS upload does not resume	It is meant: a file always arrives whole, and the resume is refused. The program uploads the file again from the start
rsync refuses `--inplace` or `--append`	It is meant, for the same reason: take them out
The account does not see the shared folder	It needs SFTP or FTPS, without rsync; the folder appears at the next connection
The account is marked Late but the backup runs	Look in Activity whether the sessions upload files; if the backup is rarer than the alert, lengthen Alert if it does not upload for
An upload just made is not in the Activity	The sessions are updated every few minutes

14. For administrators and resellers

Who administers the server or resells the service also finds:

Verification, in the page Off-site copy: every night the panel compares what the server has for the subscription (folders, owners, permissions, users, groups) with what it knows, and lists the differences. Verify now does it at once; Repair writes everything again as the panel knows it. No file is ever removed: what the server has and the panel does not know is listed and left as it is.
The backup of the configuration: the backups of the customer and of the server hold the accounts (with their passwords and keys), the shared folders and the reports, not the files: those are copies already. After a restore the programs of the customers sign in with the same credentials.
The space of the server: the administrator is alerted when the disk of the copies passes 80% and 90%; at 95% every account becomes read only, until it falls below 90%.
The API: the space, the accounts, the shared folders and the activity are also managed from the API of the panel, for provisioning and for monitoring systems.