fork 0k-charms
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

125 lines
4.1 KiB

  1. #+PROPERTY: Effort_ALL 0 0:30 1:00 2:00 0.5d 1d 1.5d 2d 3d 4d 5d
  2. #+PROPERTY: Max_effort_ALL 0 0:30 1:00 2:00 0.5d 1d 1.5d 2d 3d 4d 5d
  3. #+PROPERTY: header-args:python :var filename=(buffer-file-name)
  4. #+PROPERTY: header-args:sh :var filename=(buffer-file-name)
  5. #+TODO: TODO WIP BLOCKED | DONE CANCELED
  6. #+LATEX_HEADER: \usepackage[margin=0.5in]{geometry}
  7. #+LaTeX_HEADER: \hypersetup{linktoc = all, colorlinks = true, urlcolor = DodgerBlue4, citecolor = PaleGreen1, linkcolor = blue}
  8. #+LaTeX_CLASS: article
  9. #+OPTIONS: H:8 ^:nil prop:("Effort" "Max_effort") tags:not-in-toc
  10. #+COLUMNS: %50ITEM %Effort(Min Effort) %Max_effort(Max Effort)
  11. #+TITLE: rsync-backup-target
  12. #+LATEX: \pagebreak
  13. Usage of this service
  14. #+LATEX: \pagebreak
  15. #+LATEX: \pagebreak
  16. * Configuration example
  17. #+begin_src yaml
  18. rsync-backup-target:
  19. # docker-compose:
  20. # ports:
  21. # - "10023:22"
  22. options:
  23. admin: ## These keys are for the allowed rsync-backup to write stuff with rsync
  24. myadmin:
  25. - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDESdz8bWtVcDQJ68IE/KpuZM9tAq\
  26. ZDXGbvEVnTg16/yWqBGQg0QZdDjISsPn7D3Zr64g2qgD9n7EZghfGP9TkitvfrBYx8p\
  27. 7JkkUyt8nxklwOlKZFD5b3PF2bHloSsmjnP8ZMp5Ar7E+tn1guGrCrTcFIebpVGR3qF\
  28. hRN9AlWNR+ekWo88ZlLJIrqD26jbWRJZm4nPCgqwhJwfHE3aVwfWGOqjSp4ij+jr2ac\
  29. Arg7eD4clBPYIqKlqbfNRD5MFAH9sbB6jkebQCAUwNRwV7pKwCEt79HnCMoMjnZh6Ww\
  30. 6TlHIFw936C2ZiTBuofMx7yoAeqpifyzz/T5wsFLYWwSnX rsync@zen"
  31. #+end_src
  32. * ssh API
  33. ** Adding new keys for backup
  34. This can be done through the admin accounts configured in =compose.yml=.
  35. You can use then =ssh myadmin@$RSYNC_BACKUP_TARGET ssh-key=:
  36. #+begin_example
  37. $ ssh myadmin@$RSYNC_BACKUP_TARGET ssh-key ls
  38. $ ssh myadmin@$RSYNC_BACKUP_TARGET ssh-key add "ssh-rsa AAA...Jdhwhv rsync@sourcelabel"
  39. $ ssh myadmin@$RSYNC_BACKUP_TARGET ssh-key ls
  40. ..Jdhwhv sourcelabel
  41. $ ssh myadmin@$RSYNC_BACKUP_TARGET ssh-key rm sourcelabel
  42. $ ssh myadmin@$RSYNC_BACKUP_TARGET ssh-key ls
  43. $
  44. #+end_example
  45. ** Requesting a recover only key
  46. *** as an admin
  47. As an admin, by requesting a recover-only key on an ident that you
  48. own, you are allowed to read (and only read) the content of the given
  49. ident. This will allow you to give the credentials to any new host to
  50. have a direct read access so-as to deploy the backup on a new host.
  51. #+begin_example
  52. $ ssh myadmin@$RSYNC_BACKUP_TARGET ssh-key request-recovery-key myident > /tmp/private_key
  53. $ chmod 500 /tmp/private_key
  54. $ rsync -e "ssh -p 22 -i /tmp/private_key -l rsync" \
  55. -azvArH --delete --delete-excluded \
  56. --partial --partial-dir .rsync-partial \
  57. --numeric-ids $RSYNC_BACKUP_TARGET:/var/mirror/myident/etc/ /tmp/etc
  58. #+end_example
  59. This key will expire after 15 mn of the last recovery.
  60. *** as a standard backup account
  61. With a standard backup account, you can log on as =rsync= user and
  62. request without any arguments a recovery key. Indeed, every standard
  63. backup account is tied to one backup identifier only. So the recover
  64. key received will be for this backup identifier only.
  65. You'll probably want to use the received key from another computer to
  66. restore the backup for instance.
  67. #+begin_example
  68. $ ssh rsync@$RSYNC_BACKUP_TARGET request-recovery-key > /tmp/private_key
  69. $ chmod 500 /tmp/private_key
  70. $ rsync -e "ssh -p 22 -i /tmp/private_key -l rsync" \
  71. -azvArH --delete --delete-excluded \
  72. --partial --partial-dir .rsync-partial \
  73. --numeric-ids $RSYNC_BACKUP_TARGET:/var/mirror/myident/etc/ /tmp/etc
  74. #+end_example
  75. * Troubleshooting
  76. ** Faking access from client
  77. This should work:
  78. #+begin_src sh
  79. RSYNC_BACKUP_TARGET_IP=172.18.0.2
  80. rsync -azvA -e "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" \
  81. /tmp/toto "$RSYNC_BACKUP_TARGET":/var/mirror/client1
  82. #+end_src
  83. ** Direct ssh access should be refused
  84. #+begin_src sh
  85. RSYNC_BACKUP_TARGET_IP=172.18.0.2
  86. ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no \
  87. "$RSYNC_BACKUP_TARGET"
  88. #+end_src
  89. ** Wrong directory should be refused
  90. #+begin_src sh
  91. RSYNC_BACKUP_TARGET_IP=172.18.0.2
  92. rsync -azvA -e "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" \
  93. /tmp/toto "$RSYNC_BACKUP_TARGET":/var/mirror/client2
  94. #+end_src