Support

Akeeba Backup for Joomla!

#32721 Strange File Name Just Started

Posted in ‘Akeeba Backup for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Akeeba Backup version
n/a

Latest post by on Thursday, 23 April 2020 17:17 CDT

enktesisllc
Please look at the bottom of this page (under Support Policy Summary) for our support policy summary, containing important information regarding our working hours and our support policy. Thank you!

EXTREMELY IMPORTANT: Please attach a ZIP file containing your Akeeba Backup log file in order for us to help you with any backup or restoration issue. If the file is over 2Mb, please upload it on your server and post a link to it.

Description of my issue:

Today, out of the blue, AKEEBA started naming files strangely so instead of the time it appends a random string.

site-enktesis.com-20200323-134109-52tXJDm1KyVm_SMe.j01 23-Mar-2020 17:51 262152k
site-enktesis.com-20200323-134109-52tXJDm1KyVm_SMe.j02 23-Mar-2020 17:51 262156k
site-enktesis.com-20200323-134109-52tXJDm1KyVm_SMe.jpa 23-Mar-2020 17:51 126344k

You can download a zipped JPA file for the KeraObryon site here:
https://drive.google.com/drive/folders/1za4JL-IfcrPAzwdXXY1mBCSaLvrUaRy9?usp=sharing

Enktesis LLC Marco Ciavolino [email protected]

tampe125
Akeeba Staff
Hello,

long story short: don't worry, it was just a minor change in default archive name. You can safely ignore it.

Longer version: we made this change to make backup archives harder to guess, in the very very very (and let me say it again) very remote scenario where your output folder is readable.
Why is that so unlikely?
First of all you should have a broken server that does not respect .htaccess directives, since we put in every folder a file to block public web access. This means that you can't simply surf to any folder and download a file.
Then you should have ignored Akeeba Backup fatal errors about your output folder being web accessible, moreover Akeeba Backup will refuse to work if we detect that such folder is readable from the outside.
Finally, an attacker should know your backup name. Even if it had a default pattern, such name changes every time you take a backup, because the timestamp is included in the archive name.

Nevertheless, we still have "security" professionals that still contact us, claiming that our software is "insicure" since they could download site backups.
So we finally decided to get rid of those complains and we're adding a random string at the end of the archive.

Davide Tampellini

Developer and Support Staff

🇮🇹Italian: native 🇬🇧English: good • 🕐 My time zone is Europe / Rome (UTC +1)
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

System Task
system
This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!