LinuxWebLog.com

Excellent. Thanks for sharing this informative articles. I found another good articles about linux manual. You can check it out at pdfph.com.

I will be setting up a back-up of a remote web-host via rsync over ssh and creating the snapshot style backup as mentioned above on the local machine.

On the local backup machine:

1. Generate the private/public key pair for passwordless login via ssh to remote host.
   

   # ssh-keygen -t dsa -b 2048 -f ~/.ssh/rsync_key
   

2. Create an empty password by just hitting enter when prompted for password.
3. Protect the private key, which should only be readable by the owner.
   

   # chmod 600 ~/.ssh/rsync_key
   

4. Transfer the public key file to the remote host:

   # scp ~/.ssh/rsync_key.pub remote_host.tld:.
   

5. The backups are on separately partitioned drive and auto-mounted read-only.

   In "/etc/auto.master"

   /data/bak   /etc/auto.bak
   

   In "/etc/auto.bak"

   .snapshots      -fstype=ext3,ro,nosuid,noexec   :/dev/hdb2-vg00/lv-bak
   

6. Restart autofs:

   # service autofs restart
   

7. Create the rsync backup script to run via cron. The script also rotates out the backups creating a snapshot style backup:

   #!/bin/bash
   # rsync_backup.sh
   
   NICE=/bin/nice
   CHOWN=/bin/chown
   CHMOD=/bin/chmod
   RSYNC=/usr/bin/rsync
   SSH=/usr/bin/ssh
   MOUNT=/bin/mount
   UMOUNT=/bin/umount
   PORT=22
   KEY=~/.ssh/rsync_key
   RUSER=root
   RHOST=remote_host.tld
   RPATH='/etc /var/lib/mysql /var/www'
   LPATH=/data/bak/.snapshots
   
   
   # Mount for writing
   $MOUNT -o remount,rw,nosuid,noexec,nodev $LPATH
   
   
   # rotate backups
   pushd $LPATH
   
   if [ -f daily.0/.rsync_bak_complete ] 
   then
   
           if [ "`date +%w`" -eq 0 ] 
           then 
                   [ -d weekly.3 ] && rm -rf weekly.3
                   [ -d weekly.2 ] && mv weekly.2 weekly.3
                   [ -d weekly.1 ] && mv weekly.1 weekly.2
                   [ -d weekly.0 ] && mv weekly.0 weekly.1
                   [ -d daily.3 ] && mv daily.3 weekly.0
           fi
   
           [ -d daily.3 ] && rm -rf daily.3
           [ -d daily.2 ] && mv daily.2 daily.3
           [ -d daily.1 ] && mv daily.1 daily.2
           [ -d daily.0 ] && mv daily.0 daily.1
   
           mkdir daily.0
   
           # Adjust permissions
           $CHMOD 050 daily.0
           $CHOWN root:remote_user daily.0
   
   fi
   
   # run the rsync
   $NICE -n 12 $RSYNC -azR -e "$SSH -i $KEY -p $PORT" --exclude=/var/www/*/log --delete \
         --timeout=1800 --link-dest=../daily.1 $RUSER@$RHOST:"$RPATH" $LPATH/daily.0
   
   # Confirm backup is complete so files are rotated on the backup side
   $RSYNC -a -e "$SSH -i $KEY -p $PORT" --timeout=10 $RUSER@$RHOST:/.rsync_bak_complete $LPATH/daily.0
   
   
   popd
   
   # Unmount
   $UMOUNT $LPATH
   
   exit 0
   

8. Change the mode to be executable on the script.

   # chmod 750 /usr/local/bin/rsync_backup.sh
   

9. Add the script to crontab for a daily incremental snapshot style backup.

   # Do rsync backup
   07 06 * * * /usr/local/bin/rsync_backup.sh > /dev/null 2>&1
   

On the remote host:

1. Create script to validate the rsync command used.
   

   #!/bin/sh
   # rsync_validate.sh
   
   case "$SSH_ORIGINAL_COMMAND" in
   *\&*)
   echo "Rejected"
   ;;
   *\(*)
   echo "Rejected"
   ;;
   *\{*)
   echo "Rejected"
   ;;
   *\;*)
   echo "Rejected"
   ;;
   *\<*)
   echo "Rejected"
   ;;
   *\`*)
   echo "Rejected"
   ;;
   rsync\ --server*)
   $SSH_ORIGINAL_COMMAND
   ;;
   *)
   echo "Rejected"
   ;;
   esac 
   

2. Change the mode to be executable on the script.

   # chmod 750 /usr/local/bin/rsync_validate.sh
   

3. Modify the public key and prepend restricted host and command used, separated by just a comma and no spaces.

   from="backup_host.tld",command="/usr/local/bin/rsync_validate.sh" ssh-dss AAAAB3NzaC1kc3MAAA...
   

4. Append the public key to authorized_keys2 file.

   # cat ~/rsync-key.pub >> ~/.ssh/authorized_keys2
   

5. Modify "/etc/ssh/sshd_config" to accept forced-commands-only for root ssh login.

   PermitRootLogin forced-commands-only
   

6. Restart ssh:

   # service sshd restart
   

That should do it... the result will be an incremental backup of the last 4 days plus a weekly of the month.