Difference between revisions of "Mesh/Backup"
m (→Server setup) |
|||
Line 54: | Line 54: | ||
/bin/chmod 640 /home/clientuser/backup/* | /bin/chmod 640 /home/clientuser/backup/* | ||
/bin/chown root. | /bin/chown root.clientuser /home/clientuser/backup/* | ||
</pre> | </pre> |
Latest revision as of 01:26, 13 October 2013
Backup happens from all sudomesh servers to backup.sudomesh.org every 24 hours. The backup system uses duplicity over rsync. The backups are incremental and encrypted.
Client setup
Clients have this script in /etc/cron.daily:
#!/bin/sh /root/scripts/db_dump /root/scripts/secure_backup
and the db_dump script looks like:
#!/bin/sh /usr/bin/mysqldump --defaults-extra-file=/etc/mysql/debian.cnf --all-databases > /var/databases/all_mysql_databases.sql
and the secure_backup script looks like:
#!/bin/sh PASSPHRASE="the_duplicity_passphrase" /usr/bin/duplicity --exclude-other-filesystems / rsync://clientuser@backup.sudomesh.org/backup/
WARNING: Make sure the secure_backup file is only readable by root!
Key-based login has been set up for logging into backup.sudomesh.org by first creating the user clientuser on backup.sudomesh.org with a long random password, and then using ssh-copy-id from the client.
The passphrase is long and randomly generated and is also stored in multiple secure offline locations.
Server setup
The server has a user called clientuser which is set up to allow key-based login with the client server's public ssh key.
The home directory of clientuser looks like:
root@backup:/home/clientuser# ls -l total 12 drwxr-x--- 2 clientuser clientuser 12288 Oct 13 01:49 backup
The server has the cronjob /etc/cron.daily/backup_permissions:
#!/bin/sh # This script prevents backups from being deleted # by the user that created them. /bin/chmod 640 /home/clientuser/backup/* /bin/chown root.clientuser /home/clientuser/backup/*