freedombone-backup-remote 17KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Backup to remote servers - the web of backups
  12. # License
  13. # =======
  14. #
  15. # Copyright (C) 2015-2016 Bob Mottram <bob@freedombone.net>
  16. #
  17. # This program is free software: you can redistribute it and/or modify
  18. # it under the terms of the GNU Affero General Public License as published by
  19. # the Free Software Foundation, either version 3 of the License, or
  20. # (at your option) any later version.
  21. #
  22. # This program is distributed in the hope that it will be useful,
  23. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  24. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  25. # GNU Affero General Public License for more details.
  26. #
  27. # You should have received a copy of the GNU Affero General Public License
  28. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  29. PROJECT_NAME='freedombone'
  30. COMPLETION_FILE=$HOME/${PROJECT_NAME}-completed.txt
  31. CONFIGURATION_FILE=$HOME/${PROJECT_NAME}.cfg
  32. MONGODB_APPS_FILE=$HOME/.mongodbapps
  33. BACKUP_EXTRA_DIRECTORIES=/root/backup-extra-dirs.csv
  34. ENABLE_VERIFICATION="no"
  35. export TEXTDOMAIN=${PROJECT_NAME}-backup-remote
  36. export TEXTDOMAINDIR="/usr/share/locale"
  37. PROJECT_INSTALL_DIR=/usr/local/bin
  38. if [ -f /usr/bin/${PROJECT_NAME} ]; then
  39. PROJECT_INSTALL_DIR=/usr/bin
  40. fi
  41. source $PROJECT_INSTALL_DIR/${PROJECT_NAME}-vars
  42. # utilities needed for backup commands
  43. UTILS_FILES=/usr/share/${PROJECT_NAME}/utils/${PROJECT_NAME}-utils-*
  44. for f in $UTILS_FILES
  45. do
  46. source $f
  47. done
  48. # Temporary location for data to be backed up to other servers
  49. SERVER_DIRECTORY=/root/remotebackup
  50. # get the version of Go being used
  51. GO_VERSION=$(cat /usr/share/${PROJECT_NAME}/utils/${PROJECT_NAME}-utils-go | grep 'GO_VERSION=' | head -n 1 | awk -F '=' '{print $2}')
  52. ADMIN_USERNAME=$(get_completion_param "Admin user")
  53. ADMIN_NAME=$(getent passwd $ADMIN_USERNAME | cut -d: -f5 | cut -d, -f1)
  54. ADMIN_EMAIL_ADDRESS=${ADMIN_USERNAME}@${HOSTNAME}
  55. if [ ! -f /etc/ssl/private/backup.key ]; then
  56. echo $"Creating backup key"
  57. ${PROJECT_NAME}-addcert -h backup --dhkey 2048
  58. fi
  59. if [ ! -f /home/${ADMIN_USERNAME}/backup.list ]; then
  60. exit 1
  61. fi
  62. # MariaDB password
  63. DATABASE_PASSWORD=$(${PROJECT_NAME}-pass -u root -a mariadb)
  64. # local directory where the backup will be made
  65. if [ ! -d $SERVER_DIRECTORY ]; then
  66. mkdir $SERVER_DIRECTORY
  67. fi
  68. if [ ! -d $SERVER_DIRECTORY/backup ]; then
  69. mkdir -p $SERVER_DIRECTORY/backup
  70. fi
  71. # The name of a currently suspended site
  72. # Sites are suspended so that verification should work
  73. SUSPENDED_SITE=
  74. function suspend_site {
  75. # suspends a given website
  76. if [[ $ENABLE_VERIFICATION != "yes" ]]; then
  77. return
  78. fi
  79. SUSPENDED_SITE="$1"
  80. nginx_dissite $SUSPENDED_SITE
  81. systemctl reload nginx
  82. }
  83. function restart_site {
  84. # restarts a given website
  85. if [ ! $SUSPENDED_SITE ]; then
  86. return
  87. fi
  88. nginx_ensite $SUSPENDED_SITE
  89. systemctl reload nginx
  90. SUSPENDED_SITE=
  91. }
  92. function backup_blocklist {
  93. if [ ! -f /root/${PROJECT_NAME}-firewall-domains.cfg ]; then
  94. return
  95. fi
  96. echo $"Backing up ${PROJECT_NAME} blocklist"
  97. temp_backup_dir=/root/tempbackupblocklist
  98. if [ ! -d $temp_backup_dir ]; then
  99. mkdir -p $temp_backup_dir
  100. fi
  101. if [ -f $NODEJS_INSTALLED_APPS_FILE ]; then
  102. cp -f /root/${PROJECT_NAME}-firewall-domains.cfg $temp_backup_dir
  103. fi
  104. backup_directory_to_friend $temp_backup_dir blocklist
  105. rm -rf $temp_backup_dir
  106. }
  107. function backup_configfiles {
  108. echo $"Backing up ${PROJECT_NAME} configuration files"
  109. temp_backup_dir=/root/tempbackupconfig
  110. if [ ! -d $temp_backup_dir ]; then
  111. mkdir -p $temp_backup_dir
  112. fi
  113. if [ -f $NODEJS_INSTALLED_APPS_FILE ]; then
  114. cp -f $NODEJS_INSTALLED_APPS_FILE $temp_backup_dir
  115. fi
  116. if [ -f /root/.nostore ]; then
  117. cp -f /root/.nostore $temp_backup_dir
  118. else
  119. if [ -f $temp_backup_dir/.nostore ]; then
  120. rm $temp_backup_dir/.nostore
  121. fi
  122. fi
  123. cp -f $CONFIGURATION_FILE $temp_backup_dir
  124. cp -f $COMPLETION_FILE $temp_backup_dir
  125. if [ -f $BACKUP_EXTRA_DIRECTORIES ]; then
  126. cp -f $BACKUP_EXTRA_DIRECTORIES $temp_backup_dir
  127. fi
  128. if [ -f $MONGODB_APPS_FILE ]; then
  129. cp -f $MONGODB_APPS_FILE $temp_backup_dir
  130. fi
  131. # nginx password hashes
  132. if [ -f /etc/nginx/.htpasswd ]; then
  133. cp -f /etc/nginx/.htpasswd $temp_backup_dir/htpasswd
  134. fi
  135. backup_directory_to_friend $temp_backup_dir configfiles
  136. }
  137. function backup_users {
  138. for d in /home/*/ ; do
  139. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  140. if [[ $(is_valid_user "$USERNAME") == "1" ]]; then
  141. # personal settings
  142. if [ -d /home/$USERNAME/personal ]; then
  143. echo $"Backing up personal settings for $USERNAME"
  144. backup_directory_to_friend /home/$USERNAME/personal personal/$USERNAME
  145. fi
  146. # gpg keys
  147. if [ -d /home/$USERNAME/.gnupg ]; then
  148. echo $"Backing up gpg keys for $USERNAME"
  149. backup_directory_to_friend /home/$USERNAME/.gnupg gnupg/$USERNAME
  150. fi
  151. # ssh keys
  152. if [ -d /home/$USERNAME/.ssh ]; then
  153. echo $"Backing up ssh keys for $USERNAME"
  154. backup_directory_to_friend /home/$USERNAME/.ssh ssh/$USERNAME
  155. fi
  156. # syncthing files
  157. if [ -d /home/$USERNAME/Sync ]; then
  158. echo $"Backing up syncthing files for $USERNAME"
  159. backup_directory_to_friend /home/$USERNAME/Sync syncthing/$USERNAME
  160. # ensure that device IDs will be backed up as part of user config settings
  161. if [ ! -d /home/$USERNAME/.config/syncthing ]; then
  162. mkdir -p /home/$USERNAME/.config/syncthing
  163. chown -R $USERNAME:$USERNAME /home/$USERNAME/.config
  164. fi
  165. if [ -f /home/$USERNAME/.syncthing-server-id ]; then
  166. cp /home/$USERNAME/.syncthing-server-id /home/$USERNAME/.config/syncthing
  167. chown -R $USERNAME:$USERNAME /home/$USERNAME/.config
  168. fi
  169. if [ -f /home/$USERNAME/.syncthingids ]; then
  170. cp /home/$USERNAME/.syncthingids /home/$USERNAME/.config/syncthing
  171. chown -R $USERNAME:$USERNAME /home/$USERNAME/.config
  172. fi
  173. fi
  174. # config files
  175. if [ -d /home/$USERNAME/.config ]; then
  176. echo $"Backing up config files for $USERNAME"
  177. backup_directory_to_friend /home/$USERNAME/.config config/$USERNAME
  178. fi
  179. # monkeysphere files
  180. if [ -d /home/$USERNAME/.monkeysphere ]; then
  181. echo $"Backing up monkeysphere files for $USERNAME"
  182. backup_directory_to_friend /home/$USERNAME/.monkeysphere monkeysphere/$USERNAME
  183. fi
  184. # fin files
  185. if [ -d /home/$USERNAME/.fin ]; then
  186. echo $"Backing up fin files for $USERNAME"
  187. backup_directory_to_friend /home/$USERNAME/.fin fin/$USERNAME
  188. fi
  189. # local files
  190. if [ -d /home/$USERNAME/.local ]; then
  191. echo $"Backing up local files for $USERNAME"
  192. backup_directory_to_friend /home/$USERNAME/.local local/$USERNAME
  193. fi
  194. # mutt settings
  195. if [ -f /home/$USERNAME/.muttrc ]; then
  196. echo $"Backing up Mutt settings for $USERNAME"
  197. if [ ! -d /home/$USERNAME/tempbackup ]; then
  198. mkdir -p /home/$USERNAME/tempbackup
  199. fi
  200. cp /home/$USERNAME/.muttrc /home/$USERNAME/tempbackup
  201. if [ -f /etc/Muttrc ]; then
  202. cp /etc/Muttrc /home/$USERNAME/tempbackup
  203. fi
  204. backup_directory_to_friend /home/$USERNAME/tempbackup mutt/$USERNAME
  205. fi
  206. if [ -d /home/$USERNAME/.mutt ]; then
  207. echo $"Backing up Mutt configurations for $USERNAME"
  208. backup_directory_to_friend /home/$USERNAME/.mutt mutt/${USERNAME}configs
  209. fi
  210. # procmail settings
  211. if [ -f /home/$USERNAME/.procmailrc ]; then
  212. echo $"Backing up procmail settings for $USERNAME"
  213. if [ ! -d /home/$USERNAME/tempbackup ]; then
  214. mkdir -p /home/$USERNAME/tempbackup
  215. fi
  216. cp /home/$USERNAME/.procmailrc /home/$USERNAME/tempbackup
  217. backup_directory_to_friend /home/$USERNAME/tempbackup procmail/$USERNAME
  218. fi
  219. # spamassassin settings
  220. if [ -d /home/$USERNAME/.spamassassin ]; then
  221. echo $"Backing up spamassassin settings for $USERNAME"
  222. backup_directory_to_friend /home/$USERNAME/.spamassassin spamassassin/$USERNAME
  223. fi
  224. # email
  225. if [ -d /home/$USERNAME/Maildir ]; then
  226. echo $"Stopping mail server"
  227. systemctl stop exim4
  228. echo $"Creating an email archive"
  229. if [ ! -d /root/backupemail/$USERNAME ]; then
  230. mkdir -p /root/backupemail/$USERNAME
  231. fi
  232. tar -czvf /root/backupemail/$USERNAME/maildir.tar.gz /home/$USERNAME/Maildir
  233. echo $"Restarting mail server"
  234. systemctl start exim4
  235. echo $"Backing up emails for $USERNAME"
  236. backup_directory_to_friend /root/backupemail/$USERNAME mail/$USERNAME
  237. fi
  238. fi
  239. done
  240. }
  241. function backup_letsencrypt {
  242. if [ -d /etc/letsencrypt ]; then
  243. echo $"Backing up Lets Encrypt settings"
  244. backup_directory_to_friend /etc/letsencrypt letsencrypt
  245. fi
  246. }
  247. function backup_passwordstore {
  248. if [ -d /root/.passwords ]; then
  249. echo $"Backing up password store"
  250. backup_directory_to_friend /root/.passwords passwordstore
  251. fi
  252. }
  253. function backup_tor {
  254. if [ -d /etc/letsencrypt ]; then
  255. echo $"Backing up Tor settings"
  256. backup_directory_to_friend /var/lib/tor tor
  257. fi
  258. }
  259. function backup_certs {
  260. if [ -d /etc/ssl ]; then
  261. echo $"Backing up certificates"
  262. backup_directory_to_friend /etc/ssl ssl
  263. fi
  264. }
  265. function backup_mailing_list {
  266. if [ -d /var/spool/mlmmj ]; then
  267. echo $"Backing up the public mailing list"
  268. backup_directory_to_friend /var/spool/mlmmj mailinglist
  269. fi
  270. }
  271. function backup_web_server {
  272. if [ -d /etc/nginx ]; then
  273. echo $"Backing up web settings"
  274. backup_directory_to_friend /etc/nginx/sites-available web
  275. fi
  276. }
  277. function backup_admin_readme {
  278. if [ -f /home/$ADMIN_USERNAME/README ]; then
  279. echo $"Backing up README"
  280. if [ ! -d /home/$ADMIN_USERNAME/tempbackup ]; then
  281. mkdir -p /home/$ADMIN_USERNAME/tempbackup
  282. fi
  283. cp -f /home/$ADMIN_USERNAME/README /home/$ADMIN_USERNAME/tempbackup
  284. backup_directory_to_friend /home/$ADMIN_USERNAME/tempbackup readme
  285. fi
  286. }
  287. function backup_mariadb {
  288. if [ ${#DATABASE_PASSWORD} -gt 1 ]; then
  289. temp_backup_dir=/root/tempmariadb
  290. if [ ! -d $temp_backup_dir ]; then
  291. mkdir $temp_backup_dir
  292. fi
  293. keep_database_running
  294. mysqldump --password=$DATABASE_PASSWORD mysql user > $temp_backup_dir/mysql.sql
  295. if [ ! -s $temp_backup_dir/mysql.sql ]; then
  296. echo $"Unable to backup MariaDB settings"
  297. rm -rf $temp_backup_dir
  298. # Send a warning email
  299. echo $"Unable to export database settings" | mail -s "${PROJECT_NAME} backup to friends" $ADMIN_EMAIL_ADDRESS
  300. exit 653
  301. fi
  302. echo "$DATABASE_PASSWORD" > $temp_backup_dir/db
  303. chmod 400 $temp_backup_dir/db
  304. backup_directory_to_friend $temp_backup_dir mariadb
  305. fi
  306. }
  307. function backup_postgresql {
  308. if [ ! -d /etc/postgresql ]; then
  309. return
  310. fi
  311. temp_backup_dir=/root/temppostgresql
  312. if [ ! -d $temp_backup_dir ]; then
  313. mkdir $temp_backup_dir
  314. fi
  315. sudo -u postgres pg_dumpall --roles-only > $temp_backup_dir/postgresql.sql
  316. if [ ! -s $temp_backup_dir/postgresql.sql ]; then
  317. echo $"Unable to backup postgresql settings"
  318. rm -rf $temp_backup_dir
  319. umount $USB_MOUNT
  320. rm -rf $USB_MOUNT
  321. exit 684365
  322. fi
  323. echo "$DATABASE_PASSWORD" > $temp_backup_dir/db
  324. chmod 400 $temp_backup_dir/db
  325. backup_directory_to_friend $temp_backup_dir postgresql
  326. }
  327. # Returns the filename of a key share
  328. function get_key_share {
  329. no_of_shares=$1
  330. USERNAME="$2"
  331. REMOTE_DOMAIN="$3"
  332. # Get a share index based on the supplied domain name
  333. # This ensures that the same share is always given to the same domain
  334. sharenumstr=$(md5sum <<< "$REMOTE_DOMAIN")
  335. share_index=$(echo $((0x${sharenumstr%% *} % ${no_of_shares})) | tr -d -)
  336. # get the filename
  337. share_files=(/home/$USERNAME/.gnupg_fragments/keyshare.asc.*)
  338. share_filename=${share_files[share_index]}
  339. echo "$share_filename"
  340. }
  341. function disperse_key_shares {
  342. USERNAME=$1
  343. REMOTE_DOMAIN=$2
  344. REMOTE_SSH_PORT=$3
  345. REMOTE_PASSWORD=$4
  346. REMOTE_SERVER=$5
  347. if [ -d /home/$USERNAME/.gnupg_fragments ]; then
  348. if [ $REMOTE_DOMAIN ]; then
  349. cd /home/$USERNAME/.gnupg_fragments
  350. no_of_shares=$(ls -afq keyshare.asc.* | wc -l)
  351. if (( no_of_shares > 1 )); then
  352. share_filename=$(get_key_share $no_of_shares "$USERNAME" "$REMOTE_DOMAIN")
  353. # create a temp directory containing the share
  354. temp_key_share_dir=/home/$USERNAME/tempkey
  355. temp_key_share_fragments=$temp_key_share_dir/.gnupg_fragments_${USERNAME}
  356. mkdir -p $temp_key_share_fragments
  357. cp $share_filename $temp_key_share_fragments/
  358. # copy the fragments directory to the remote server
  359. /usr/bin/sshpass -p "$REMOTE_PASSWORD" \
  360. scp -r -P $REMOTE_SSH_PORT $temp_key_share_fragments $REMOTE_SERVER
  361. if [ ! "$?" = "0" ]; then
  362. # Send a warning email
  363. echo "Key share to $REMOTE_SERVER failed" | \
  364. mail -s "${PROJECT_NAME} social key management" $MY_EMAIL_ADDRESS
  365. else
  366. # Send a confirmation email
  367. echo "Key ${share_filename} shared to $REMOTE_SERVER" | \
  368. mail -s "${PROJECT_NAME} social key management" $MY_EMAIL_ADDRESS
  369. fi
  370. # remove the temp file/directory
  371. shred -zu $temp_key_share_fragments/*
  372. rm -rf $temp_key_share_dir
  373. fi
  374. fi
  375. fi
  376. }
  377. TEST_MODE="no"
  378. if [[ "$1" == "test" ]]; then
  379. TEST_MODE="yes"
  380. fi
  381. backup_configfiles
  382. if [[ $TEST_MODE == "no" ]]; then
  383. backup_blocklist
  384. backup_users
  385. backup_letsencrypt
  386. backup_passwordstore
  387. backup_tor
  388. backup_web_server
  389. backup_admin_readme
  390. backup_mariadb
  391. backup_postgresql
  392. backup_certs
  393. backup_mailing_list
  394. backup_apps remote
  395. backup_extra_directories remote
  396. fi
  397. # For each remote server
  398. while read remote_server
  399. do
  400. # Get the server and its password
  401. # Format is:
  402. # username@domain <port number> /home/username <ssh password>
  403. REMOTE_SERVER=$(echo "${remote_server}" | awk -F ' ' '{print $1}')
  404. if [ $REMOTE_SERVER ]; then
  405. REMOTE_DOMAIN=$(echo "${remote_server}" | awk -F ' ' '{print $1}' | awk -F '@' '{print $2}')
  406. REMOTE_SSH_PORT=$(echo "${remote_server}" | awk -F ' ' '{print $2}')
  407. REMOTE_DIRECTORY=$(echo "${remote_server}" | awk -F ' ' '{print $3}')
  408. REMOTE_PASSWORD=$(echo "${remote_server}" | awk -F ' ' '{print $4}')
  409. NOW=$(date +"%Y-%m-%d %H:%M:%S")
  410. REMOTE_SERVER=$REMOTE_SERVER:$REMOTE_DIRECTORY
  411. echo "$NOW Starting backup to $REMOTE_SERVER" >> /var/log/remotebackups.log
  412. # Social key management
  413. for d in /home/*/ ; do
  414. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  415. if [[ $(is_valid_user "$USERNAME") == "1" ]]; then
  416. disperse_key_shares $USERNAME $REMOTE_DOMAIN $REMOTE_SSH_PORT "$REMOTE_PASSWORD" $REMOTE_SERVER
  417. fi
  418. done
  419. if [[ $TEST_MODE == "yes" ]]; then
  420. echo "rsync -ratlzv --rsh=\"/usr/bin/sshpass -p '$REMOTE_PASSWORD' ssh -p $REMOTE_SSH_PORT -o StrictHostKeyChecking=no\" $SERVER_DIRECTORY/backup $REMOTE_SERVER"
  421. fi
  422. rsync -ratlzv --rsh="/usr/bin/sshpass -p \"$REMOTE_PASSWORD\" ssh -p $REMOTE_SSH_PORT -o StrictHostKeyChecking=no" $SERVER_DIRECTORY/backup $REMOTE_SERVER
  423. if [ ! "$?" = "0" ]; then
  424. echo "$NOW Backup to $REMOTE_SERVER failed" >> /var/log/remotebackups.log
  425. # Send a warning email
  426. echo "Backup to $REMOTE_SERVER failed" | mail -s "${PROJECT_NAME} backup to friends" $ADMIN_EMAIL_ADDRESS
  427. else
  428. echo "$NOW Backed up to $REMOTE_SERVER" >> /var/log/remotebackups.log
  429. fi
  430. fi
  431. done < /home/${ADMIN_USERNAME}/backup.list
  432. exit 0