evobackup/bkctld

#!/bin/bash
#
# bkctld is a shell script to create and manage a backup server which will
# handle the backup of many servers (clients).

usage(){
    echo "Usage: $0 <subcommand> [options]"
    echo "Subcommands:"
    echo "	init		<jailname>					Init jail <jailname>"
    echo "	update		<jailname>|all					Update jail <jailname> or all"
    echo "	remove		<jailname>|all					Remove jail <jailname> or all"
    echo "	start		<jailname>|all					Start jail <jailname> or all"
    echo "	stop		<jailname>|all					Stop jail <jailname> or all"
    echo "	reload		<jailname>|all					Reload jail <jailname> or all"
    echo "	restart		<jailname>|all					Restart jail <jailname> or all"
    echo "	sync		<jailname>|all					Sync jail <jailname> or all to another node"
    echo "	status		[<jailname>]					Print status of <jailname> (default all jail)"
    echo "	key		<jailname>		[<keyfile>]		Set or get ssh pubic key of <jailname>"
    echo "	port		<jailname>		[<ssh_port>|auto]	Set or get ssh port of <jailname>"
    echo "	ip		<jailname>		[<ip>|all]		Set or get allowed(s) ip(s) of <jailname>"
    echo "	inc								Make incremental inc of all jails"
    echo "	rm								Remove old incremtal inc of all jails"
    echo ""
}
  
sub_init() {
	jail=$1
	if ( check_btrfs); then
		btrfs subvolume create ${JAILDIR}/${jail}
	else
		mkdir -p ${JAILDIR}/${jail}
	fi
	mk_jail $jail
	echo -n "4 - Copie default sshd_config..."
	install -m 0640 ${TPLDIR}/sshd_config ${JAILDIR}/$jail/${SSHD_CONFIG}
	echo "...OK"
	echo -n "5 - Set usable sshd port..."
	set_port $jail auto
	echo "...OK"
	echo -n "6 - Copie default inc configuration..."
	install -m 0640 ${TPLDIR}/inc.tpl ${CONFDIR}/$jail
	echo "...OK"
}

sub_update() {
	jail=$1
	status=$(check_jail_on $jail)
	if ( $status ); then
		$0 stop $jail			
	fi
	mk_jail $jail
	if ( $status ); then
                $0 start $jail
        fi
}

sub_remove() {
	jail=$1
        if ( check_jail_on $jail ); then
                $0 stop $jail
        fi
	if ( check_btrfs ); then
		btrfs subvolume delete ${JAILDIR}/${jail}
		rm -f ${CONFDIR}/${jail}
		if [ -d  ${INCDIR}/${jail} ]; then
			btrfs subvolume delete ${INCDIR}/${jail}/*
			rmdir ${INCDIR}/${jail}
		fi
	else
		rm -rf ${JAILDIR}/${jail}
		rm -f ${CONFDIR}/${jail}
		rm -rf ${INCDIR}/${jail}
	fi
}

sub_start() {
	jail=$1
	if ( $(check_jail_on $jail) ); then
		echo "Jail $jail already running !" >&2
		exit 1
	fi
	mount -t proc proc-${jail} ${JAILDIR}/${jail}/proc/
	mount -nt tmpfs dev-${jail} ${JAILDIR}/${jail}/dev
	mknod -m 622 ${JAILDIR}/${jail}/dev/console c 5 1
	mknod -m 666 ${JAILDIR}/${jail}/dev/null c 1 3
	mknod -m 666 ${JAILDIR}/${jail}/dev/zero c 1 5
	mknod -m 666 ${JAILDIR}/${jail}/dev/ptmx c 5 2
	mknod -m 666 ${JAILDIR}/${jail}/dev/tty c 5 0
	mknod -m 444 ${JAILDIR}/${jail}/dev/random c 1 8
	mknod -m 444 ${JAILDIR}/${jail}/dev/urandom c 1 9
	chown root:tty ${JAILDIR}/${jail}/dev/{console,ptmx,tty}
	ln -s ${JAILDIR}/${jail}/proc/self/fd ${JAILDIR}/${jail}/dev/fd
	ln -s ${JAILDIR}/${jail}/proc/self/fd/0 ${JAILDIR}/${jail}/dev/stdin
	ln -s ${JAILDIR}/${jail}/proc/self/fd/1 ${JAILDIR}/${jail}/dev/stdout
	ln -s ${JAILDIR}/${jail}/proc/self/fd/2 ${JAILDIR}/${jail}/dev/stderr
	ln -s ${JAILDIR}/${jail}/proc/kcore ${JAILDIR}/${jail}/dev/core
	mkdir ${JAILDIR}/${jail}/dev/pts
	mkdir ${JAILDIR}/${jail}/dev/shm
	mount -t devpts -o gid=4,mode=620 none ${JAILDIR}/${jail}/dev/pts
	mount -t tmpfs none ${JAILDIR}/${jail}/dev/shm
        chroot ${JAILDIR}/${jail} /usr/sbin/sshd -D &
	#umount -R ${JAILDIR}/${jail}/dev
        #umount ${JAILDIR}/${jail}/proc/
}

sub_stop() {
	jail=$1
	if ( ! $(check_jail_on $jail) ); then
		echo "Jail $jail is not running !" >&2
		exit 1
	fi
	pid=$(cat ${JAILDIR}/${jail}/${SSHD_PID})
	for conn in $(ps --ppid $pid -o pid=); do
		kill $conn
	done
	kill $pid
	umount -R ${JAILDIR}/${jail}/dev
        umount ${JAILDIR}/${jail}/proc/
}

sub_reload() {
	jail=$1
	if [ $(check_jail_on $jail) ]; then
		pkill -HUP -F ${JAILDIR}/${jail}/${SSHD_PID}
	fi
}

sub_restart() {
	set -e
	jail=$1
	$0 stop $jail	
	$0 start $jail	
}

sub_status() {
	jail=$1
	inc=$(check_inc $jail)
	if ($(check_jail_on $jail)); then
		status="ON "
	else
		status="OFF"
	fi
	port=$(get_port $jail)
	ip=$(get_ip $jail|xargs)
	echo "$jail		$status		$port		$inc	$ip"
}

sub_sync() {
	if [ -z $NODE ]; then
		echo "You must define \$NODE in /etc/default/evobackup !" >&2
		exit 1
	fi
	jail=$1
	port=$(get_port $jail)
	key=$(get_key $jail)
	rsync -a ${CONFDIR}/$jail $NODE:${CONFDIR}/$jail
	bkctld key $jail > /tmp/evobackup-${jail}.pub
	rsync -a /tmp/evobackup-${jail}.pub $NODE:/tmp/evobackup-${jail}.pub
	ssh $NODE bkctld init $jail
	ssh $NODE bkctld port $jail $port
	ssh $NODE bkctld key $jail /tmp/evobackup-${jail}.pub
	for ip in $(get_ip $jail); do
		ssh $NODE bkctld ip $jail $ip
	done
}

sub_inc() {
	date=$(date +"%Y-%m-%d-%H")
	for jail in $(ls -1 $JAILDIR); do
		inc="${INCDIR}/${jail}/${date}"
		mkdir -p ${INCDIR}/${jail}
		if [ ! -d "${inc}" ]; then
			/bin/date +"%d-%m-%Y ; %H:%M" >> $LOGFILE
			if ( check_btrfs ); then
				btrfs subvolume snapshot ${JAILDIR}/$jail $inc >> $LOGFILE
			else
				echo -n "hard copy $jail begins at : " >> $LOGFILE
				cp -alx ${JAILDIR}/${jail}/ ${INCDIR}${jail}/$date
				echo -n "hard copy $JAIL ends at : " >> $LOGFILE
			fi
			/bin/date +"%d-%m-%Y ; %H:%M" >> $LOGFILE
		fi
	done
	#| tee -a $LOGFILE | mail -s "[info] EvoBackup - create incs" $MYMAIL
}

sub_rm() {
	for jail in $( ls -1 $JAILDIR ); do
		incs=$(ls -1 ${INCDIR}/$jail)
		if [ -f ${CONFDIR}/$jail ]; then
		        keep=$(
				while read j; do
		        	        date=$( echo $j | cut -d. -f1 )
		                	before=$( echo $j | cut -d. -f2 )
			                date -d "$(date $date) $before" "+%Y-%m-%d"
		        	done < ${CONFDIR}/$jail
			)
		fi
	        for j in $( grep -v -f <(echo "${keep}") <(echo "${incs}") ); do
		        echo -n "Delete $jail/$j begins at : " >> $LOGFILE
		        /bin/date +"%d-%m-%Y ; %H:%M" >> $LOGFILE
			if ( check_btrfs ); then
				[ -n "$j" ] && btrfs subvolume delete ${INCDIR}/$jail/$j && touch /tmp/evobackup-rm.txt
			else
				cd ${INCDIR}/$jail
			        [ -n "$j" ] && rsync -a --delete /dev/null $j*
			        [ -n "$j" ] && rmdir $j* && touch /tmp/evobackup-rm.txt
			fi
		        echo -n "Delete ${jail}/$j ends at : " >> $LOGFILE
		        /bin/date +"%d-%m-%Y ; %H:%M" >> $LOGFILE
	        done
	done #| tee -a $LOGFILE | ( [ -e "/tmp/evobackup-rm.txt" ] && mail -s "[info] EvoBackup - purge incs" $MYMAIL && rm /tmp/evobackup-rm.txt )
}

mk_jail() {
	jail=$1
	umask 022

	echo -n "1 - Creating the chroot..."
	mkdir -p ${JAILDIR}/${jail}/{bin,dev,etc/ssh,lib,lib64,proc}
	mkdir -p ${JAILDIR}/${jail}/lib/{x86_64-linux-gnu,tls/i686/cmov,i686/cmov}
	mkdir -p ${JAILDIR}/${jail}/usr/{bin,lib,sbin}
	mkdir -p ${JAILDIR}/${jail}/usr/lib/{x86_64-linux-gnu,openssh,i686/cmov}
	mkdir -p ${JAILDIR}/${jail}/root/.ssh && chmod 700 ${JAILDIR}/${jail}/root/.ssh
	mkdir -p ${JAILDIR}/${jail}/var/{log,run/sshd}
	touch ${JAILDIR}/${jail}/var/log/{authlog,lastlog,messages,syslog}
	touch ${JAILDIR}/${jail}/etc/fstab
	echo "...OK"

	echo -n "2 - Copying essential files..."
	cp /proc/devices ${JAILDIR}/${jail}/proc
	cp /etc/ssh/{ssh_host_rsa_key,ssh_host_dsa_key} ${JAILDIR}/${jail}/etc/ssh/
	cp ${TPLDIR}/{passwd,shadow,group} ${JAILDIR}/${jail}/etc/
	echo "...OK"

	echo -n "3 - Copying binaries..."
	cp -f /lib/ld-linux.so.2 ${JAILDIR}/${jail}/lib/ 2>/dev/null || cp -f /lib64/ld-linux-x86-64.so.2 ${JAILDIR}/${jail}/lib64/
	cp /lib/x86_64-linux-gnu/libnss* ${JAILDIR}/${jail}/lib/x86_64-linux-gnu/

	for dbin in /bin/bash /bin/cat /bin/chown /bin/mknod /bin/rm /bin/ls /bin/sed /bin/sh /bin/uname /bin/mount /usr/bin/rsync /usr/sbin/sshd /usr/lib/openssh/sftp-server; do
		cp -f $dbin ${JAILDIR}/${jail}/$dbin;
		for lib in $(ldd $dbin | grep -Eo "/.*so.[0-9\.]+"); do
			cp -p $lib ${JAILDIR}/${jail}/$lib
		done
	done
	echo "...OK"
}

check_jail() {
	jail=$1
	if [ -d ${JAILDIR}/${jail} ]; then
		exit 0
	else
		exit 1
	fi
}

check_jail_on() {
	jail=$1
        if [ -f ${JAILDIR}/${jail}/${SSHD_PID} ]; then
                pid=$(cat ${JAILDIR}/${jail}/${SSHD_PID})
                ps -p $pid > /dev/null
                if [ $? == 0 ]; then
                        exit 0
                else
			rm ${JAILDIR}/${jail}/${SSHD_PID}
	                umount -R ${JAILDIR}/${jail}/dev
			umount ${JAILDIR}/${jail}/proc/
			exit 1
		fi
        else
		exit 1
	fi
	echo $status
}

check_inc() {
	jail=$1
	inc="0"
        if [ -f ${CONFDIR}/${jail} ]; then
                day=$(grep -c "day" ${CONFDIR}/${jail})
                month=$(grep -c "month" ${CONFDIR}/${jail})
                inc="${day}/${month}"
        fi
	echo $inc
}

check_btrfs() {
	grep $(dirname $JAILDIR) /etc/fstab|grep -q btrfs
	if [[ $? -eq 0 ]]; then
                exit 0
        fi
	grep $JAILDIR /etc/fstab|grep -q btrfs
	if [[ $? -ne 0 ]]; then
		exit 1
	fi
	grep $INCDIR /etc/fstab|grep -q btrfs
	if [[ $? -ne 0 ]]; then
		exit 1
	fi
	exit 0
}

get_port() {
	jail=$1
	port=$(grep -E "Port [0-9]+" ${JAILDIR}/${jail}/${SSHD_CONFIG}|grep -oE "[0-9]+")
	echo $port
}

set_port() {
	jail=$1
	port=$2
	if [ "$port" = "auto" ]; then
		port=$(grep -h Port ${JAILDIR}/*/${SSHD_CONFIG} 2>/dev/null | grep -Eo [0-9]+ | sort -n | tail -1)
	        port=$((port+1))
        	if [ ! $port -gt 1 ]; then
	                port=2222
	        fi
	fi
        sed -i "s/^Port .*/Port ${port}/" ${JAILDIR}/$jail/${SSHD_CONFIG}
	set_firewall $jail
}

get_key() {
	jail=$1
	if [ -f ${JAILDIR}/${jail}/${AUTHORIZED_KEYS} ]; then
		cat ${JAILDIR}/${jail}/${AUTHORIZED_KEYS}
	fi
}

set_key() {
	jail=$1
	keyfile=$2
	if [ -f $keyfile ]; then
		cat $keyfile > ${JAILDIR}/${jail}/${AUTHORIZED_KEYS}
		chmod 600 ${JAILDIR}/${jail}/${AUTHORIZED_KEYS}
	else
		echo "Keyfile $keyfile dosen't exist !" >&2
		exit 1
	fi
}

get_ip() {
	jail=$1
	for allow in $(grep -E "^AllowUsers" ${JAILDIR}/$jail/${SSHD_CONFIG}|grep -Eo "root@[^ ]+"); do
		echo $allow|cut -d'@' -f2
	done
}

set_ip() {
	jail=$1
	ip=$2
	if [[ $ip = "all" || $ip = "0.0.0.0/0" ]]; then
		ips="0.0.0.0/0"
	else
		ips=$(get_ip $jail)
		ips=$(echo $ips $ip|xargs -n1|grep -v "0.0.0.0/0"|sort|uniq)
	fi
	allow="AllowUsers"
	for ip in $ips; do
		allow="$allow root@${ip}"
	done
	sed -i "s~^AllowUsers .*~${allow}~" ${JAILDIR}/$jail/${SSHD_CONFIG}
	set_firewall $jail
}

set_firewall() {
	jail=$1
	if [ -f $FIREWALL_RULES ]; then
		sed -i "/#${jail}$/d" $FIREWALL_RULES
	fi
	port=$(get_port $jail)
	for ip in $(get_ip $jail); do
		echo "/sbin/iptables -A INPUT -p tcp --sport 1024: --dport $port -s $ip -j ACCEPT #$jail" >> $FIREWALL_RULES
	done
}

main() {
	if [ $(id -u) != 0 ]; then
	    echo "Error, you need to be root to run $0 !" >&2
	    exit 1
	fi
	if [ -f /etc/default/evobackup ]; then
		source /etc/default/evobackup
	else
		echo "Error, you need /etc/default/evobackup !" >&2
		exit 1
	fi
	mkdir -p $CONFDIR $JAILDIR $INCDIR
	subcommand=$1
	jail=$2
	option=$3
	case $subcommand in
	    "" | "-h" | "--help")
	        usage
	        ;;
	    "inc" | "rm")
		sub_${subcommand} $jail
		;;
            "init")
		if [[ -n "${jail}" ]]; then
			if ( ! $(check_jail $jail) ); then
				sub_${subcommand} $jail
			fi
		fi
		;;
	    "key" | "port" | "ip")
		if [[ -n "${jail}" ]]; then
			if ( $(check_jail $jail) ); then
	        		if [ -z "${option}" ]; then
			                get_${subcommand} $jail
			        else
			                set_${subcommand} $jail $option
			        fi
			fi
		fi
		;;
	    "start" | "stop" | "reload" | "restart" | "sync" | "update" | "remove")
		if [[ -n "${jail}" ]]; then
			if [[ "${jail}" = "all" ]]; then
				for jail in $(ls $JAILDIR); do
		                        $0 ${subcommand} $jail
		                done
			else
			        if ( $(check_jail $jail) ); then
					sub_${subcommand} $jail
				fi
			fi
		fi
		;;
	    "status")
		if [[ -z "${jail}" ]]; then
			for jail in $(ls $JAILDIR); do
	                        $0 ${subcommand} $jail
	                done
		else
			if ( $(check_jail $jail) ); then
                	        sub_${subcommand} $jail
                        fi
		fi
		;;
	    *)
	        shift
	        echo "Error: '$subcommand' is not a known subcommand." >&2
		usage
	       	exit 1
	        ;;
	esac
}

main "$@"