Open-source alternatives to Acronis and Veeam

Backups are the one bit of IT nobody thinks about until the morning they need one. Acronis and Veeam are both good products, and I wouldn't blame anyone for paying for them. But if you are running a small firm and the renewal has come in, it's worth knowing what the open-source tools can do.

First, a fair point for Veeam. Its Community Edition is free for up to 10 workloads, and that may be all a small business needs. It's not open source, though, Veeam points you to its paid plans for technical support, and the licence bars you from using it to provide services to third parties. If you want something you can keep using whatever the vendor decides next, read on.

restic

restic is a single program that backs up files from Linux, BSD, Mac and Windows, and stores them almost anywhere.

• Always encrypted. Backups are encrypted with AES-256 before they leave the machine, using a key derived from your password. Your storage provider just sees scrambled data.
• Deduplicated. Files are split into chunks and each chunk is stored once, so the daily backup only sends what has changed.
• Lots of places to put it. A local disk, a server over SFTP, Amazon S3 and anything compatible with it, Backblaze B2, Azure, Google Cloud Storage, or dozens more through rclone.
• It can check itself. restic check verifies the repository, and --read-data downloads the lot and verifies the actual contents. You can check a slice at a time to avoid a huge download.

The catch is that restic is a tool, not a product. There is no web console and no built-in scheduler. Someone has to write the script, schedule it, decide how long to keep things and watch for failures.

BorgBackup

Borg does a similar job, and it has been around for a long time. It has deduplication, a choice of compression (from very fast lz4 to slow but small lzma), and client-side encryption using 256-bit AES.

It backs up to any host you can reach over SSH, and runs best with Borg installed on the far end too. Its stand-out feature is append-only mode. If a machine gets hacked, the attacker can't permanently delete the backups on the server. That's worth having in a ransomware world, though it needs care: normal pruning can undo the protection, and disk space isn't freed until you do it.

Two things to know. The stable version is 1.4, and Borg 2 is still in beta, with the project saying plainly not to use it for production backups. And there's no native Windows version, only experimental support through Windows Subsystem for Linux. For a Windows-heavy office, that rules it out.

UrBackup

UrBackup is the odd one out, and it's the closest in feel to the paid products. You run a backup server, put a client on each machine and manage everything from a web page.

• File and image backups. Full and incremental, running while people carry on working.
• Whole-disk images of Windows PCs, plus a restore USB stick to bring a dead machine back. Note that image backups are Windows only. Linux clients do file backups.
• Laptops are covered. Machines outside the office can back up over the internet, encrypted in transit.
• Runs on most things, including Windows, Linux, Docker and several NAS boxes.

There are two limits. Local network transfers aren't encrypted, so the manual recommends trusted networks only. And UrBackup's manual doesn't describe encrypting the backups once they're stored, so if that server gets stolen you want the disk itself encrypted. You'll also want a second copy somewhere else, because one server in the office isn't an off-site backup.

Which one?

My pick is restic. It covers the most ground for a small firm: it runs on every common system, encrypts by default and sends backups straight to cheap off-site storage. The main drawback is that there's no console, so someone has to set it up, watch it and test the restores.

• Servers and a few machines, off-site storage: restic.
• Linux servers backing up to your own box, with ransomware protection high on the list: BorgBackup.
• An office full of Windows PCs, and you want disk images and a web console: UrBackup.

The UK angle

• Backups contain everything. Customer records, staff files, emails. Under UK GDPR you're responsible for that data wherever the backup lives, so know where it is and how long you keep it.
• Encrypt before it leaves. restic always does this and Borg can too, which makes the choice of storage provider much less of a worry. Pick a UK or EU storage region if you prefer, but US-based storage is fine for most small firms as long as the provider's terms and transfer arrangements stack up.
• You hold the keys. With client-side encryption, nobody at the storage company can read your backups. Nor can you, if you lose the password.

Honest drawbacks

• A lost password means lost backups. restic has no recovery route. Store the password somewhere safe, away from the thing you're backing up.
• No vendor to ring at 2am. Veeam's paid plans include 24/7 production support. Here, support is whoever set it up, plus the community.
• Less for virtual machines and Microsoft 365. Veeam protects VMware, Hyper-V, Proxmox and Microsoft 365 directly. These three are mostly about files and disks.
• No "it just works" dashboard with restic or Borg. Silent failures are the real danger, so alerting matters.
• Untested backups aren't backups. That's true of the paid tools too, but with these it's entirely on you to schedule a test restore.

If you want backups wired into your own systems, or a proper dashboard that shouts when one fails, the team at Dev Partners can build that.

Sources

• restic website
• restic: preparing a repository (storage options)
• restic: working with repositories
• restic: design and references
• BorgBackup documentation
• BorgBackup: append-only mode notes
• Borg 2 beta warning (project README)
• UrBackup features
• UrBackup downloads
• UrBackup administration manual
• Veeam free products
• Veeam Data Platform Essentials
• Veeam small business solutions
• Veeam licensing policy
• Acronis True Image plans