Virtual Architects Support Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== BackupPC ======

===== Installation on Centos 5 =====

[[computing:linux:minimal_centos_install|Minimal Server Install (Centos)]]

http://wiki.centos.org/HowTos/BackupPC

<file>
cd /etc/yum.repos.d
wget http://dev.centos.org/centos/5/CentOS-Testing.repo
yum update -y
reboot
</file>

<file>
yum --enablerepo=c5-testing install backuppc httpd mod_perl sudo wget rsync
rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/i386/ssmtp-2.61-14.el5.i386.rpm
</file>

<file>
vi /etc/ssmtp/ssmtp.conf

root=postmaster@yourdomain.tld
mailhub=mail.yourdomain.tld:465
RewriteDomain=yourdomain.tld
UseTLS=YES
AuthUser=smtpuser
AuthPass=smtppass
</file>

<file>
vi /etc/httpd/conf/httpd.conf

User backuppc
Servername backuppc.domain.com:80
</file>

<file>
vim /etc/httpd/conf.d/backuppc.conf

Allow from all
</file>

<file>
htpasswd -c /var/lib/backuppc/passwd/htpasswd admin
</file>

(enter password for web user 'admin' twice)

<file>
visudo

Comment out 'Defaults requiretty' and add the two lines

#Defaults    requiretty
Defaults !lecture
backuppc ALL=NOPASSWD:/bin/gtar,/bin/tar
</file>

<file>
vim /etc/BackupPC/config.pl
</file>

(many edits)

<file>
service httpd start
service backuppc start
chkconfig httpd on
chkconfig backuppc on
</file>

http://ip.of.backuppc.server

<file>
vi /etc/fstab

/dev/VolGroup00/LogVol00 /      ext3    defaults,noatime        1 1
</file>

===== Move Data to New Server =====

Copy old BackupPC to new server:

<file>
rsync -arv /home/backuppc/* root@123.123.123.123:/var/lib/backuppc/

reboot
</file>

===== Older Info =====

http://www.mantic.org/wiki/Installing_BackupPC

<file>
useradd backuppc
passwd backuppc
</file>

http://easynews.dl.sourceforge.net/sourceforge/backuppc/BackupPC-3.0.0.tar.gz

<file>
vi /etc/xen/appserv
#disk = [ 'tap:aio:/vm/Xen/appserv.img,xvda,w', ]
disk = [ 'tap:aio:/vm/Xen/appserv.img,xvda,w', 'phy:sda6,sda1,w', ]
</file>

<file>
fdisk -l
</file>

(shows no valid partition table on /dev/sda - mount it anyway)

copy backuppc user (dot) files to newly mounted space 

<file>
mount /dev/sda1 /home/backuppc/
</file>

Use 'noatime' option to reduce disk writes to update the file access times:

<file>
vim /etc/fstab

/dev/sda1      /home/backuppc          ext3    defaults,noatime        1 2
</file>

<file>
mount -a
</file>

<file>
perl configure.pl --batch \
                  --cgi-dir /var/www/cgi-bin/backuppc \
                  --data-dir /home/backuppc \
                  --hostname hostname.yourdomain.tld \
                  --html-dir /var/www/html/backuppc \
                  --html-dir-url /backuppc \
                  --install-dir /opt/backuppc

yum install perl-IO-Dirent --enablerepo=rpmforge
</file>

===== Add BackupPC Users =====

:!: These settings determine who can access the BackupPC web console.

<file>
htpasswd -c /etc/httpd/conf.d/backuppc.users admin
</file>

(-c creates file - use for first user)

<file>
htpasswd /etc/httpd/conf.d/backuppc.users username
</file>

You can configure the IP addresses/ranges from which the BackupPC Admin web pages are available by editing /etc/httpd/conf.d/backuppc.conf.  Signal the web server that changes were made with:

<file>
httpd -k graceful
</file>

===== Web Server Configuration =====

<file>
vim /etc/httpd/conf.d/backuppc.conf

Redirect permanent /backup https://hostname.yourdomain.tld/cgi-bin/backuppc/BackupPC_Admin

<Directory /var/www/cgi-bin/backuppc/>
    AddHandler cgi-script .pl
    Options +ExecCGI
    Order deny,allow
    Deny from all
    Allow from 123.123.123.123 234.234.234
    AuthName "Backup Admin"
    AuthType Basic
    AuthUserFile /etc/httpd/conf.d/backuppc.users
    Require valid-user
</Directory>
</file>

Added to /etc/httpd/conf/httpd.conf just before last (Include) line:

<file>
Redirect permanent /backup https://hostname.yourdomain.tld/cgi-bin/backuppc/BackupPC_Admin
</file>

===== Notes =====

  * Web server runs as user 'apache'
  * BackupPC_Admin runs 'suid'

http://hostname.yourdomain.tld/cgi-bin/backuppc/BackupPC_Admin

<file>
yum install perl-suidperl 

wget http://dag.wieers.com/rpm/packages/rpmforge-release/rpmforge-release-0.3.6-1.el5.rf.i386.rpm

rpm -Uvh rpmforge-release-0.3.6-1.el5.rf.i386.rpm

yum install perl-File-RsyncP --enablerepo=rpmforge
</file>

Added to /etc/httpd/conf/httpd.conf just before last (Include) line:

<file>
Redirect permanent /backup https://hostname.yourdomain.tld/cgi-bin/backuppc/BackupPC_Admin
</file>

backuppc.conf

<file>
$sshPath -q -x -l backuppc $host nice -n 19 /usr/bin/sudo /usr/bin/rsync --server --sender $argList+

$sshPath -l root $host /usr/bin/mysqldump --add-drop-table -A -Q > /root/backup/mysql_backup.sql

$sshPath -l root $host /usr/bin/pg_dumpall --clean -U postgres > /root/backup/postgres_backup.dump
</file>

Used on www and a variation on appserv (localhost) or anywhere more security is required 

This methodology would insulate the remote host (or even localhost) from a hacked backuppc user on the BackupPC server.  

Create backuppc user on remote host to be backed up.

Create SSH key files:

<file>
su -s /bin/bash backuppc                # use -s to specify a shell if backuppc user has no shell
                                        # configure backuppc user with no shell for added security
ssh-keygen -t rsa -b 2048               # use a blank passphrase
</file> 

Use a modified command to exchange keys:

<file>
scp ~backuppc/.ssh/id_rsa.pub backuppc@$remote_host:~/.ssh/authorized_keys
</file>

Check the password-less login to the remote host from the BackupPC server like this:

<file>
su -s /bin/bash backuppc                #become backuppc user
ssh -l backuppc <host_or_IP_to_be_backed_up>
exit                                    #from the remote_host
exit                                    #from the backuppc user back to root
</file>

<file>
visudo

#Defaults    requiretty

## Allow non-privileged user to back up
backuppc  ALL=NOPASSWD: /usr/bin/rsync --server --sender *

## Allow non-privileged user to back up AND restore
backuppc  ALL=NOPASSWD: /usr/bin/rsync --server *

## Allow non-privileged user to dump databases
backuppc  ALL=NOPASSWD: /usr/local/bin/db_backup.sh *
</file>

<file>
vi /usr/local/bin/db_backup.sh

chmod 700 /usr/local/bin/db_backup.sh
</file>

===== db_backup.sh =====

(updated) will dump both Postgresql and Mysql databases

<file>
$sshPath -l backuppc $host /usr/bin/sudo /usr/local/bin/db_backup.sh

$sshPath -l backuppc $host /usr/bin/sudo /usr/bin/mysqldump -u root -par15fal --add-locks --add-drop-table -A -Q > /opt/backuppc/sql_backup/mysql_backup.sql

/usr/bin/ssh -l root bla 'mysqldump -u root -pxyz
all-databases --add-locks > /var/backuppc-prepare/backup-all-databases.sql
</file>

===== MySQL Backup Scripts (SME 7) (example) =====

<file>
[root@sol ~]# cat /etc/e-smith/events/pre-backup/S10mysql-delete-dumped-tables
#!/bin/sh

exec /bin/rm -f /home/e-smith/db/mysql/*.dump

[root@sol ~]# cat /etc/e-smith/events/pre-backup/S20mysql-dump-tables         
#!/bin/sh

status=$(/sbin/e-smith/config getprop mysqld status)
if [ "$status" = "disabled" ]
then
    echo "mysqld is disabled - no tables dumped" >&2
    exit 0
fi
for db in $(mysql -BNre "show databases;")
do
    mysqldump --add-drop-table -QB "$db" -r /home/e-smith/db/mysql/"$db".dump || exit 1
done
</file>

Configure backuppc User RSA Keys on Server and on Remote Hosts Used with Sudo for Extra Security  

<file>
su -s /bin/bash backuppc
ssh-keygen -t rsa
exit
</file>

===== Add Linux Host =====

:!: Sonora Comm's default client configuration is for SME Server.  For other Linux servers, be sure to override the shares and paths to be backed up.

Run these commands as 'root' on the BackupPC server.

<file>
su -s /bin/bash backuppc
remote_host=xxxx
ssh-keyscan -t rsa $remote_host >> ~backuppc/.ssh/known_hosts
</file>

Then install the BackupPC server's public key to the remote server using **one of the three** following equivalent commands:

If 'ssh-copy-id' tool is present:

<file>
ssh-copy-id user@$remote_host
</file>

If it is not:

<file>
scp ~/.ssh/id_rsa.pub root@$remote_host:/root/.ssh/authorized_keys
</file>

If the remote host SSH daemn listens on a non-standard SSH port (2222 in this case):

<file>
cat ~/.ssh/id_rsa.pub | ssh -p 2222 root@$remote_host 'umask 077; cat >>.ssh/authorized_keys'
</file>

If the SSH keys have not been set up on the remote host (creating the ~/.ssh folder), do this as 'root' on the remote host:

<file>
ssh-keygen -t rsa
</file>

You can test the key exchange, as the backuppc user:

<file>
ssh -l root $remote_host
exit
</file>

Using the BackupPC Hosts panel, add a host to be backed up.

Leave the DHCP flag off ('0') if the host name can be resolved.  You can use the following to test name resolution if you aren't sure.

<file>
perl -e 'print(gethostbyname("remote.host.name") ? "ok\n" : "not found\n");'
</file>

===== Complete Backup/Restore =====

http://wpkg.org/BackupPC_-_restoring_backups_from_command_line

http://www.howtoforge.com/forums/showthread.php?t=2717

===== Getting that First Full Backup =====

Strategy: Exclude large directories then add them bit by bit

Break host backups into pieces rather than one large share.

===== Change Client Hostname =====

  - Edit /etc/BackupPC/hosts
  - Rename (if it exists) /etc/BackupPC/pc/hostname.pl
  - Rename /var/lib/backuppc/pc/hostname folder
  - service restart backuppc

===== Performance Tweaks =====

  - More Memory
  - Fast disks!
    * Particularly with Lots of Small Files
  - Enable Write-Caching on RAID Card
    * Battery Required
  - Use XFS Filesystem
    * ''noatime,nodiratime,logbufs=8''
  - Mount Backup Partition with ''noatime'' Option
  - Mounting the backuppc data partition with ''data=ordered'' option may help too
    * The default is data=writeback
  - IO::Direct perl module
    * For BackupPC 3.1?
  - Implement rsync ''checksum-seed'' option

<file>
vmstat 3
iostat
</file>

  * Multiple BackupPC Servers
  * Lower compression level
  * Don't use RAID5
  * Use ''tar'' instead of ''rsync'' (LAN ?)
  * Fewer simultaneous backups

===== Testing and Troubleshooting =====

View currentlly running backup log:

<file>
BackupPC_zcat /var/lib/backuppc/pc/hostname.clientdomain.tld/XferLOG.z |tail
</file>

Use the PID of the rsync process to see what files are open/being processed:

<file>
lsof -p <pid>
</file>

==== Test Backup ====

Using this method, you can start the backup job in the background then view the resultant log file even if you disconnect and reconnect later.

At the BackupPC server, manually fire off a backup job, redirect the output to a log file, then view it: 

<file>
su -s /bin/bash -c "/usr/bin/BackupPC_dump -v -f your.remote.host" - backuppc > test_backup.log &

tail -f test_backup.log
</file>
Virtual Architects Support Wiki

User Tools

Site Tools

Page Tools
