Compromised production tricking backup into pruning

OpenZFS Sanoid
1

I’m trying to set up ZFS snapshot replication with Sanoid/Syncoid using a pull architecture. Snapshots are pruned from the backup server with Sanoid.

I’m considering a scenario where production is compromised, creating bogus snapshots to trick the backup server into pruning valuable data upon the next pull.

What are the best practices for handling this? I imagine either Sanoid would need to be sufficiently intelligent about what it prunes, beyond snapshot names, or I could have the backup server set holds on snapshots. Am I stuck developing my own service or is this a solved problem?

Thanks!

2

Pruning is usually date based, so it doesn’t matter how many snapshots or changes production makes, you’ll still have X number of days to find out production is hosed.
NEW data won’t be transferred if you run out of space, not old stuff.