rm -rf: an easy way to destroy your internet business and your reputation
With one team, the owner of a small hosting provider deleted client data and backups
Photo: independent.co.uk
The other day, the user of the Serverfault site posted an interesting question on the resource. Marco Marsala asked other users if the rm -rf {foo} / {bar} command could be used to recover data promptly. As it turned out, Marsala is the owner of a small hosting company serving about 1,500 clients. For data management and process automation, he used Ansible.
')
One evening Marsala accidentally entered the rm -rf {foo} / {bar} command, running it on all servers. The variables {foo} / {bar} were not specified by the user. Initially, Marsala wanted to delete certain directories on different servers, but because of the above problem, everything was deleted. In this case, the backup media were physically connected and mounted, so this data was also deleted.
There were a lot of answers to the question, and most of them pointed to the impossibility of returning all the files somehow quickly. Yes, something can be restored, commentators said, but you can forget about restoring all data. In one of the answers, Marco Marsala advised to forget about restoring files and contact a lawyer to prevent the negative consequences of claims of clients whose sites were destroyed.
Some commentators believe that data can be saved, since rm -rf simply marks data blocks as empty. And if nothing was overwritten, in theory, almost everything can be restored. However, recovery will take a lot of time and money.
It is interesting that two years ago a similar question was asked on the same resource. Then the system administrator asked for help, running the following command:
sudo rm -rf --no-preserve-root / mnt / hetznerbackup /
According to the hapless sysadmin, he realized the mistake after a few seconds, but it was too late, all the data were gradually destroyed. Then it turned out that most of the important data was destroyed and could not be recovered.
Well, the advice here can be only one - to make backups. Many backups do not happen, while they should be stored so as not to be accidentally destroyed, as in this case.
UPD . The owner turned for help to the company, which is engaged in data recovery. As it turned out, all the files are in place. But the hosting provider is not in a position to afford to recover these files - too much money is needed to do this work for disks with 1500 servers.
Photo: independent.co.uk
The other day, the user of the Serverfault site posted an interesting question on the resource. Marco Marsala asked other users if the rm -rf {foo} / {bar} command could be used to recover data promptly. As it turned out, Marsala is the owner of a small hosting company serving about 1,500 clients. For data management and process automation, he used Ansible.
')
One evening Marsala accidentally entered the rm -rf {foo} / {bar} command, running it on all servers. The variables {foo} / {bar} were not specified by the user. Initially, Marsala wanted to delete certain directories on different servers, but because of the above problem, everything was deleted. In this case, the backup media were physically connected and mounted, so this data was also deleted.
There were a lot of answers to the question, and most of them pointed to the impossibility of returning all the files somehow quickly. Yes, something can be restored, commentators said, but you can forget about restoring all data. In one of the answers, Marco Marsala advised to forget about restoring files and contact a lawyer to prevent the negative consequences of claims of clients whose sites were destroyed.
Some commentators believe that data can be saved, since rm -rf simply marks data blocks as empty. And if nothing was overwritten, in theory, almost everything can be restored. However, recovery will take a lot of time and money.
It is interesting that two years ago a similar question was asked on the same resource. Then the system administrator asked for help, running the following command:
sudo rm -rf --no-preserve-root / mnt / hetznerbackup /
According to the hapless sysadmin, he realized the mistake after a few seconds, but it was too late, all the data were gradually destroyed. Then it turned out that most of the important data was destroyed and could not be recovered.
Well, the advice here can be only one - to make backups. Many backups do not happen, while they should be stored so as not to be accidentally destroyed, as in this case.
UPD . The owner turned for help to the company, which is engaged in data recovery. As it turned out, all the files are in place. But the hosting provider is not in a position to afford to recover these files - too much money is needed to do this work for disks with 1500 servers.
Source: https://habr.com/ru/post/392925/
All Articles