Radical Server Unit/3.Treffen

aus Metalab, dem offenen Zentrum für meta-disziplinäre Magier und technisch-kreative Enthusiasten.
Wechseln zu: Navigation, Suche

Nächstes Thema: "Selber Housing" - Rechner selbst aufsetzen

Andere Themen bzw. Themenvorschläge

Radical Server Unit - Backups - 2016-05-31

Weitere Dinge die Du Dir ansehen kannst:

Unix, Linux, BSD, OS X, command line tools, scripts:

borg backup

Talk auf der Gulaschprogrammiernacht 2016

OS X Utilities

Android (Rooted)

iOS

  • iTunes (bei OS X dabei, unbedingt "verschlüsselt" anhaken.
  • Nicht zu empfehlen, auch wenns komfortabel ist
    • Apple iCloud (Sind IMMER plaintext, können auch nicht verschlüsselt werden)

Duplicity Backups made easy

Duplicity Provides encrpted and incremental backups for Linux, *BSD, OSX. Uses librsync, gpg, tar, bzip, sftp,....

  1. First of all we will set up ssh config locally so we can reference our Host for the backups as "backup-host"
  2. Generate a SSH-Keypair for connecting to the host with ssh-keygen (see man for details)
  3. Choose between a basic setup or chrooted sftp only users for maximum paranoia.
    • If you want chrooted sftp only users on your sshd add/modify your servers ssh config according to "Server side for CHROOTED USERS"
    • If you do not want changerooted users serverside, skip step 3)
  4. Pick a Duplicity Command from below based on your requirements. Examples are provided for encryption with either passphrase or GPG Public Key. Make sure you choose your example based on sftp vs normal user on the server.


SSH Client side config

 Host backup-host
     HostName backup-host.example.com
     Port 22
     User BACKUP-USERNAME
     IdentityFile /home/localuser/.ssh/id_rsa


GPG key for only home (run as user) -non chroot

Before first run:

 gpg --recv-keys GPG_key


Run/do Backups

 duplicity /home/USERNAME/ \
     --encrypt-key GPG_KEY \
         --full-if-older-than 12M \
         --asynchronous-upload \
         --exclude /home/USERNAME_LOCAL/.cache \
         --exclude /home/USERNAME_LOCAL/Downloads \
         --exclude /home/USERNAME_LOCAL/.wine \
         --exclude /home/USERNAME_LOCAL/.VirtualBox \
         --exclude /home/USERNAME_LOCAL/.gvfs \
         --exclude /home/USERNAME_LOCAL/.kvm \
         sftp://backup-host/home/BACKUP-USERNAME/2015

Passphrase key for only home (run as user) -non chroot

 export PASSPHRASE=_________YOUR_PASSPHRASE_GOES_HERE_____________
 duplicity /home/USERNAME/ \
     --encrypt-key GPG_KEY \
         --full-if-older-than 12M \
         --asynchronous-upload \
         --exclude /home/USERNAME_LOCAL/.cache \
         --exclude /home/USERNAME_LOCAL/Downloads \
         --exclude /home/USERNAME_LOCAL/.wine \
         --exclude /home/USERNAME_LOCAL/.VirtualBox \
         --exclude /home/USERNAME_LOCAL/.gvfs \
         --exclude /home/USERNAME_LOCAL/.kvm \
         sftp://backup-host/home/BACKUP-USERNAME/2015
 unset PASSPHRASE


Server side for CHROOTED USERS

add the group sftp_users

add to /etc/ssh/sshd_config

 AuthorizedKeysFile      /etc/ssh/AUTH-KEYS-USERS/%u
 Match group sftp_users
     ChrootDirectory %h
     ForceCommand internal-sftp
     AllowTcpForwarding no
     AllowAgentForwarding no
     PermitTunnel no
     PermitTTY no
     X11Forwarding no


make directory for client public keys in /etc/sshd

 mkdir -p /etc/ssh/AUTH-KEYS-USERS/


add a new user for the sftp only access and add him sftp user group


 nano /etc/ssh/AUTH-KEYS-USERS/__username___
 chown -R __username___:sftp_users /etc/ssh/AUTH-KEYS-USERS/__username___
 chown root:root /home/__username___


Passphrase for only home (run as user)

 export PASSPHRASE=_________YOUR_PASSPHRASE_GOES_HERE_____________
 duplicity /home/USERNAME/ \
         --full-if-older-than 12M \
         --asynchronous-upload \
         --exclude /home/USERNAME_LOCAL/.cache \
         --exclude /home/USERNAME_LOCAL/Downloads \
         --exclude /home/USERNAME_LOCAL/.wine \
         --exclude /home/USERNAME_LOCAL/.VirtualBox \
         --exclude /home/USERNAME_LOCAL/.gvfs \
         --exclude /home/USERNAME_LOCAL/.kvm \
         sftp://backup-host/2016
 unset PASSPHRASE


Passphrase for all files (run as root)

 export PASSPHRASE=_________YOUR_PASSPHRASE_GOES_HERE_____________
 duplicity / \
         --full-if-older-than 12M \
         --asynchronous-upload \
         --volsize 500 \
         --exclude /dev \
         --exclude /media \
         --exclude /mnt \
         --exclude /proc \
         --exclude /run \
         --exclude /sys \
         --exclude /tmp \
         --exclude /home/USERNAME_LOCAL/.cache \
         --exclude /home/USERNAME_LOCAL/Downloads \
         --exclude /home/USERNAME_LOCAL/.wine \
         --exclude /home/USERNAME_LOCAL/.VirtualBox \
         --exclude /home/USERNAME_LOCAL/.gvfs \
         --exclude /home/USERNAME_LOCAL/.kvm \
         sftp://backup-host/2016
 unset PASSPHRASE


GPG key for only home (run as user)

Before first run:

 gpg --recv-keys GPG_key


do backups:

 duplicity /home/USERNAME/ \
     --encrypt-key GPG_KEY \
         --full-if-older-than 12M \
         --asynchronous-upload \
         --exclude /home/USERNAME_LOCAL/.cache \
         --exclude /home/USERNAME_LOCAL/Downloads \
         --exclude /home/USERNAME_LOCAL/.wine \
         --exclude /home/USERNAME_LOCAL/.VirtualBox \
         --exclude /home/USERNAME_LOCAL/.gvfs \
         --exclude /home/USERNAME_LOCAL/.kvm \
         sftp://backup-host/2016