The duty to backup - Yet another BackupPC tutorial

When thinking about the design of the backup process and singling out eligible software it became obvious that i didn`t want a homebrew scripting solution. I wanted a clear system to backup a network with different operating systems (MacOS X, Windows, Linux). My search led me to BackupPC.

• Appealing GUI for data restore,
• trouble-free handling of umlauts and blanks in path and file names,
• users have access their own backups,
• handling of mobile devices,
• in-depth documentation,
• Pooling, i.d. identical data is stored only once.

These notes don`t want to be more than a mnemonic rhyme. Maybe you'll find some helpful details don't forget to read the manual. The links at the bottom of this page may lead you through that topic. Pathnames in this article are related to Gentoo Linux, you should find them on other linux flavours, too.

BackupPC basically a webserver is not needed, the webfrontend is the recommended way to administer the server. (screenshots). For that you need a running webserver. (e.g. Apache)

Apache

BackupPC is written in perl. The recommended configuration uses the module mod_perl.

Activate it /etc/conf.d/apache2:

APACHE2_OPTS="-D PERL"

http://localhost/perl-status shows you if and how mod_perl had been installed.

In my scenario apache also serves multiple local domains and is set up for name-based virtual hosts (vhosts). The backup server is accessible via localhost as default vhost.

create /etc/apache2/vhosts.d/backuppc.include with

<Directory /var/www/localhost/cgi-bin>
        SetHandler perl-script
        PerlResponseHandler ModPerl::Registry
        PerlOptions +ParseHeaders
        Options +ExecCGI +Indexes
        AllowOverride AuthConfig 
        Order deny,allow
        Deny from all
        Allow from 192.168.foo 127.0.0.1
        AuthName "backuppc"
        AuthType Basic
        AuthUserFile /usr/local/etc/apache2/.htpasswd
        Require valid-user
</Directory>

/etc/apache2/vhosts.d/00_default_vhost.conf: After the entry

default_vhost.include

the new file has to be included:

Include /etc/apache2/vhosts.d/backuppc.include

Set up users for the web frontend:

htpasswd  /usr/local/etc/apache2/.htpasswd backuppc
htpasswd  /usr/local/etc/apache2/.htpasswd userA
htpasswd  /usr/local/etc/apache2/.htpasswd userB

For use with BackupPC Apache needs to run with backuppc's rights.
httpd.conf:

User backuppc
Group backuppc

localhost   0       backuppc userA
computerB    0       userA
computerC    0       userB

Apache runs as backuppc so trouble may be caused with existing local websites because of missing permissions. For that you can add backuppc to the apache group

usermod -aG apache backuppc

and adjust group permissions of affected paths. Another maybe cleaner approach is to set up another web server (e.g. lighttp), start two instances of apache, second one in a virtual machine or host a server on a separate pc.

BackupPC

For the backup process to run as root with full file permissions, extent backuppc's permissions by visudo. In the example backuppc is granted permission to execute rsync to backup and to mount and unmount partitions like e.g. /boot.

backuppc    ALL=(ALL)       NOPASSWD: /usr/bin/rsync *,/bin/mount *,/bin/umount *

How to backup

Every pc gets his own configuration file:
/etc/BackupPC/pc/hostname.pl

Adjusting the backup command for localhost:

$Conf{RsyncClientCmd} = '/usr/bin/sudo $rsyncPath $argList+';
$Conf{RsyncClientRestoreCmd} = '/usr/bin/sudo $rsyncPath $argList+';

Enabling the root access via sudo should also be done on remote Linux or MacOSX clients.

Mounting of paths that usually are unmounted. If databases should be backed up, here's the place for any commands to dump your database data to a directory backed up by BackupPC.

$Conf{DumpPreUserCmd} = '/usr/bin/sudo mount /boot';
$Conf{DumpPostUserCmd} = '/usr/bin/sudo umount /boot';
$Conf{RestorePreUserCmd} = '/usr/bin/sudo mount /boot';
$Conf{RestorePostUserCmd} = '/usr/bin/sudo umount /boot';

What to backup

$Conf{RsyncShareName}, $Conf{BackupFilesExclude}

defines which paths to backup with exemptions,

$Conf{BlackoutPeriods}

times of the day when no backup should run.

SSH tunnel

The choosen rsync method works flawlessly over a ssl tunnel. i.d. BackupPC does roughly the same as a normal user who logs into a remote client using ssh user@hostname. For the automatic way it's indispensable that user backuppc is able to log in without typing any password. Procedure: For each user in the backup network you'll have to create a key-pair without entering any password:

ssh-keygen -t rsa

The public key id_rsa.pub from user backuppc needs to be copied into ~/.ssh/authorized_keys from userA.

cat backuppc_id_rsa.pub >> ~/.ssh/authorized_keys

In this example of ~/.ssh/authorized_keys an IP filter is set for more security.

from="192.168.foo.foo" ssh-rsa c2EAAAABIwAAA(...)Qb69lo== backuppc@server-hostname

on the server userA's public key has to be added

cat userA_id_rsa.pub >> ~/.ssh/known_hosts

To make the hosts known it's easier to connect via command line - see the testcommand below. To validate the computer's fingerprint to which we want to connect:

ssh-keygen -l

/etc/ssh/ssh_host_rsa_key.pub

Example known_hosts

computerA,192.168.foo.foo ssh-rsa IwAAAQEAq2PwH9(...)qDmlogB==

The home directory of backuppc must exist.
Testing the connection: Logged in as user backuppc

ssh userA@computerB

you open the tunnel. Is that working BackupPC is told to do it the same way.

$Conf{RsyncClientCmd} = '$sshPath -q -x -l userA $host /usr/bin/sudo $rsyncPath $argList+';
$Conf{RsyncClientRestoreCmd} = '$sshPath -q -x -l userA $host /usr/bin/sudo $rsyncPath $argList+';

WOL (wake on lan)

PCs which go into sleep mode after a while are woken up by

Conf{PingCmd} = '/etc/BackupPC/pc/wakeup.sh 00:16:cb:a3:39:64 1 $host';

where /etc/BackupPC/pc/wakeup.sh looks like:

#!/bin/bash
# Any output on stdout confuses BackupPC
wakeonlan $1 &>/dev/null
# time in minutes to wake up comfortable
sleep ${2}m
# is the host accessible?
/bin/ping -c 1 -w 3 $3

Mac OSX boxes: system preferences - energy saver - "Wake for Ethernet network administrator access" activate this. Mac Laptops with Snow Leopard (>2009) can be woken up, if the power supply is connected and the lid stays open.
On Windows you'll find these settings in the network card's property dialog. Where you'll find these settings depends on your hardware.
Example for a SiS 900-based PCI-Fast Ethernet-Adapter: Device manager -> network adapter -> power management -> activate "activate the computer from the stand-by mode" AND "only administration stations can activate stand-by computers".

Links:

• BackupPC's own documentation
• In-depth tutorial
• Search facility for the mailing list backuppc-users' archive
• Access Your Computer Anytime and Save Energy with Wake-on-LAN