evobackup/bkctld

#!/bin/sh
#
# bkctld is a shell script to create and manage a backup server which will
# handle the backup of many servers (clients).
#
# Author: Victor Laborie <vlaborie@evolix.fr>
# Contributor: Benoît Série <bserie@evolix.fr>, Gregory Colpart <reg@evolix.fr>, Romain Dessort <rdessort@evolix.fr>, Tristan Pilat <tpilat@evolix.fr>
# Licence: AGPLv3
#

usage(){
    echo "Usage: $0 <subcommand> [options]"
    echo "Subcommands:"
    echo "	init		<jailname>					Init jail <jailname>"
    echo "	update		<jailname>|all					Update jail <jailname> or all"
    echo "	remove		<jailname>|all					Remove jail <jailname> or all"
    echo "	start		<jailname>|all					Start jail <jailname> or all"
    echo "	stop		<jailname>|all					Stop jail <jailname> or all"
    echo "	reload		<jailname>|all					Reload jail <jailname> or all"
    echo "	restart		<jailname>|all					Restart jail <jailname> or all"
    echo "	sync		<jailname>|all					Sync jail <jailname> or all to another node"
    echo "	status		[<jailname>]					Print status of <jailname> (default all jail)"
    echo "	key		<jailname>		[<keyfile>]		Set or get ssh pubic key of <jailname>"
    echo "	port		<jailname>		[<ssh_port>|auto]	Set or get ssh port of <jailname>"
    echo "	ip		<jailname>		[<ip>|all]		Set or get allowed(s) ip(s) of <jailname>"
    echo "	inc								Make incremental inc of all jails"
    echo "	rm								Remove old incremtal inc of all jails"
    echo ""
}

## check functions

check_jail() {
	jail=$1
	if [ -d ${JAILDIR}/${jail} ]; then
		exit 0
	else
		exit 1
	fi
}

check_jail_on() {
	jail=$1
	return=1
	if [ -f ${JAILDIR}/${jail}/${SSHD_PID} ]; then
	        pid=$(cat ${JAILDIR}/${jail}/${SSHD_PID})
	        ps -p $pid > /dev/null && return=0
	fi
	if [ "$return" -eq 1 ]; then
		rm -f ${JAILDIR}/${jail}/${SSHD_PID}
		grep -q "${JAILDIR}/${jail}/proc" /proc/mounts && umount --lazy ${JAILDIR}/${jail}/proc/
	        grep -q "${JAILDIR}/${jail}/dev" /proc/mounts && umount --lazy --recursive ${JAILDIR}/${jail}/dev
	fi
	exit "$return"
}

## get functions : get info on jail

get_port() {
	jail=$1
	port=$(grep -E "Port [0-9]+" ${JAILDIR}/${jail}/${SSHD_CONFIG}|grep -oE "[0-9]+")
	echo $port
}

get_key() {
	jail=$1
	if [ -f ${JAILDIR}/${jail}/${AUTHORIZED_KEYS} ]; then
		cat ${JAILDIR}/${jail}/${AUTHORIZED_KEYS}
	fi
}

get_ip() {
	jail=$1
	grep -E "^AllowUsers" "${JAILDIR}/$jail/${SSHD_CONFIG}"|grep -Eo "root@[^ ]+"| while read allow; do
		echo "$allow"|cut -d'@' -f2
	done
}

get_inc() {
	jail=$1
	inc="0"
        if [ -f ${CONFDIR}/${jail} ]; then
                day=$(grep -c "day" ${CONFDIR}/${jail})
                month=$(grep -c "month" ${CONFDIR}/${jail})
                inc="${day}/${month}"
        fi
	echo $inc
}

## set functions : set info on jail

set_port() {
	jail=$1
	port=$2
	if [ "$port" = "auto" ]; then
		port=$(grep -h Port ${JAILDIR}/*/${SSHD_CONFIG} 2>/dev/null | grep -Eo "[0-9]+" | sort -n | tail -1)
	        port=$((port+1))
        	if [ ! $port -gt 1 ]; then
			port=2222
	        fi
	fi
        sed -i "s/^Port .*/Port ${port}/" ${JAILDIR}/$jail/${SSHD_CONFIG}
	set_firewall $jail
}

set_key() {
	jail=$1
	keyfile=$2
	if [ -e $keyfile ]; then
		cat $keyfile > ${JAILDIR}/${jail}/${AUTHORIZED_KEYS}
		chmod 600 ${JAILDIR}/${jail}/${AUTHORIZED_KEYS}
	else
		echo "Keyfile $keyfile dosen't exist !" >&2
		exit 1
	fi
}

set_ip() {
	jail=$1
	ip=$2
	if [ "$ip" = "all" ] || [ "$ip" = "0.0.0.0/0" ]; then
		ips="0.0.0.0/0"
	else
		ips=$(get_ip $jail)
		ips=$(echo $ips $ip|xargs -n1|grep -v "0.0.0.0/0"|sort|uniq)
	fi
	allow="AllowUsers"
	for ip in $ips; do
		allow="$allow root@${ip}"
	done
	sed -i "s~^AllowUsers .*~${allow}~" ${JAILDIR}/$jail/${SSHD_CONFIG}
	set_firewall $jail
}

set_firewall() {
	jail=$1
	if [ -n "${FIREWALL_RULES}" ]; then
		if [ -f $FIREWALL_RULES ]; then
			sed -i "/#${jail}$/d" $FIREWALL_RULES
		fi
		if ( check_jail $jail ); then
			port=$(get_port $jail)
			for ip in $(get_ip $jail); do
				echo "/sbin/iptables -A INPUT -p tcp --sport 1024: --dport $port -s $ip -j ACCEPT #$jail" >> $FIREWALL_RULES
			done
			if [ -f /etc/init.d/minifirewall ]; then
				/etc/init.d/minifirewall restart >/dev/null
			fi
		fi
	fi
}

## mk_jail function : create or update a jail

mk_jail() {
	jail=$1
	passwd="${TPLDIR}/passwd"
	shadow="${TPLDIR}/shadow"
	group="${TPLDIR}/group"
	sshrc="${TPLDIR}/sshrc"
	[ -f "${LOCALTPLDIR}/passwd" ] && passwd="${LOCALTPLDIR}/passwd"
	[ -f "${LOCALTPLDIR}/shadow" ] && shadow="${LOCALTPLDIR}/shadow"
	[ -f "${LOCALTPLDIR}/group" ] && group="${LOCALTPLDIR}/group"
	[ -f "${LOCALTPLDIR}/sshrc" ] && group="${LOCALTPLDIR}/sshrc"
	umask 077

	echo "1 - Creating the chroot"
	cd "${JAILDIR}/${jail}"
	rm -rf bin lib lib64 run usr var/run etc/ssh/*key
	mkdir -p dev proc
	mkdir -p usr/bin usr/sbin usr/lib usr/lib/x86_64-linux-gnu usr/lib/openssh usr/lib64
	mkdir -p etc/ssh var/log run/sshd
	mkdir -p root/.ssh var/backup -m 0700
	ln -s usr/bin bin
	ln -s usr/lib lib
	ln -s usr/lib64 lib64
	ln -st var ../run
	touch var/log/lastlog var/log/wtmp run/utmp

	echo "2 - Copying essential files"
	[ -f /etc/ssh/ssh_host_rsa_key ] && cp /etc/ssh/ssh_host_rsa_key etc/ssh
	[ -f /etc/ssh/ssh_host_ecdsa_key ] && cp /etc/ssh/ssh_host_ecdsa_key etc/ssh
	[ -f /etc/ssh/ssh_host_ed25519_key ] && cp /etc/ssh/ssh_host_ed25519_key etc/ssh
	cp "$passwd" etc
	cp "$shadow" etc
	cp "$group" etc
	cp "$sshrc" etc/ssh

	echo "3 - Copying binaries"
	cp -f /lib/ld-linux.so.2 lib 2>/dev/null || cp -f /lib64/ld-linux-x86-64.so.2 lib64
	cp /lib/x86_64-linux-gnu/libnss* lib/x86_64-linux-gnu

	for dbin in /bin/sh /bin/ls /bin/mkdir /bin/cat /bin/rm /bin/sed /usr/bin/rsync /usr/bin/lastlog /usr/bin/touch /usr/sbin/sshd /usr/lib/openssh/sftp-server; do
		cp -f $dbin ${JAILDIR}/${jail}/$dbin;
		for lib in $(ldd $dbin | grep -Eo "/.*so.[0-9\.]+"); do
			cp -p $lib ${JAILDIR}/${jail}/$lib
		done
	done
}

## sub functions : functions call by subcommand
  
sub_init() {
	jail=$1
	sshd_config="${TPLDIR}/sshd_config"
	inctpl="${TPLDIR}/inc.tpl"
	[ -f "${LOCALTPLDIR}/sshd_config" ] && sshd_config="${LOCALTPLDIR}/sshd_config"
	[ -f "${LOCALTPLDIR}/inc.tpl" ] && inctpl="${LOCALTPLDIR}/inc.tpl"
	if ( check_jail $jail ); then
		echo "Jail $jail already exist ! Use '$0 update $jail' for update it" >&2
                exit 1		
	fi

	echo "Create jail $jail :"
	rootdir=$(dirname "$JAILDIR")
	rootdir_inode=$(stat --format=%i "$rootdir")
	jaildir_inode=$(stat --format=%i $JAILDIR)
	if [ "$rootdir_inode" -eq 256 ] || [ "$jaildir_inode" -eq 256 ]; then
		$BTRFS subvolume create ${JAILDIR}/${jail}
	else
		mkdir -p ${JAILDIR}/${jail}
	fi
	mk_jail $jail
	echo "4 - Copie default sshd_config"
	install -m 0640 $sshd_config ${JAILDIR}/$jail/${SSHD_CONFIG}
	echo "5 - Set usable sshd port"
	set_port $jail auto
	echo "6 - Copie default inc configuration"
	install -m 0640 $inctpl ${CONFDIR}/$jail
}

sub_update() {
	jail=$1
	if ! ( check_jail $jail ); then
		echo "Jail $jail doesn't exist ! Use '$0 init $jail' for create it !" >&2
                exit 1
	fi
	
	status=$(check_jail_on $jail)
	if ( $status ); then
		log stop $jail
	fi
	echo "Update jail $jail :"
	mk_jail $jail
	if ( $status ); then
	        log start $jail
	fi
}

sub_remove() {
	jail=$1
	if ! ( check_jail $jail ); then
		echo "Jail $jail doesn't exist !" >&2
                exit 1
	fi

	if ( check_jail_on $jail ); then
	        log stop $jail
	fi
	echo "Delete jail $jail"
	rm -f ${CONFDIR}/${jail}
	jail_inode=$(stat --format=%i ${JAILDIR}/${jail})
	if [ "$jail_inode" -eq 256 ]; then
		$BTRFS subvolume delete ${JAILDIR}/${jail}
	else
		rm -rf ${JAILDIR}/${jail}
	fi
	if [ -d  ${INCDIR}/${jail} ]; then
		incs=$(ls ${INCDIR}/${jail})
		for inc in $incs; do
			inc_inode=$(stat --format=%i ${INCDIR}/${jail}/$inc)
			if [ "$inc_inode" -eq 256 ]; then
				$BTRFS subvolume delete ${INCDIR}/${jail}/${inc}
			else
				echo "You need to purge ${INCDIR}/${jail}/$inc manually !" >&2
			fi
		done
		rmdir --ignore-fail-on-non-empty ${INCDIR}/${jail}
	fi
	set_firewall $jail
}

sub_start() {
	jail=$1
	if ! ( check_jail $jail ); then
                echo "Jail $jail doesn't exist ! Create it with '$0 init $jail'" >&2
                exit 1
        fi
	if ( check_jail_on $jail ); then
		echo "Jail $jail already running !" >&2
		exit 1
	fi

	echo "Start jail $jail"
	cd "${JAILDIR}/${jail}"
	grep -q "${JAILDIR}/${jail}/proc" /proc/mounts || mount -t proc "proc-${jail}" proc
	grep -q "${JAILDIR}/${jail}/dev" /proc/mounts || mount -nt tmpfs "dev-${jail}" dev
	[ -e "dev/console" ] || mknod -m 622 dev/console c 5 1
	[ -e "dev/null" ] || mknod -m 666 dev/null c 1 3
	[ -e "dev/zero" ] || mknod -m 666 dev/zero c 1 5
	[ -e "dev/ptmx" ] || mknod -m 666 dev/ptmx c 5 2
	[ -e "dev/tty" ] || mknod -m 666 dev/tty c 5 0
	[ -e "dev/random" ] || mknod -m 444 dev/random c 1 8
	[ -e "dev/urandom" ] || mknod -m 444 dev/urandom c 1 9
	chown root:tty dev/console dev/ptmx dev/tty
	ln -fs proc/self/fd dev/fd
	ln -fs proc/self/fd/0 dev/stdin
	ln -fs proc/self/fd/1 dev/stdout
	ln -fs proc/self/fd/2 dev/stderr
	ln -fs proc/kcore dev/core
	mkdir -p dev/pts
	mkdir -p dev/shm
	grep -q "${JAILDIR}/${jail}/dev/pts" /proc/mounts || mount -t devpts -o gid=4,mode=620 none dev/pts
	grep -q "${JAILDIR}/${jail}/dev/shm" /proc/mounts || mount -t tmpfs none dev/shm
	chroot "${JAILDIR}/${jail}" /usr/sbin/sshd
}

sub_stop() {
	jail=$1
	if ! ( check_jail $jail ); then
                echo "Jail $jail doesn't exist !" >&2
                exit 1
        fi
	if ! ( check_jail_on $jail ); then
		echo "Jail $jail doesnt't run !" >&2
		exit 1
	fi

	echo "Stop jail $jail"
	pid=$(cat ${JAILDIR}/${jail}/${SSHD_PID})
	for conn in $(ps --ppid $pid -o pid=); do
		kill $conn
	done
	kill $pid
	umount --lazy --recursive ${JAILDIR}/${jail}/dev
	umount --lazy ${JAILDIR}/${jail}/proc/
}

sub_reload() {
	jail=$1
	if ! ( check_jail $jail ); then
                echo "Jail $jail doesn't exist !" >&2
                exit 1
        fi
	if ! ( check_jail_on $jail ); then
		echo "Jail $jail doesnt't run !" >&2
		exit 1
	fi

	echo "Reload jail $jail"
	pkill -HUP -F ${JAILDIR}/${jail}/${SSHD_PID}
}

sub_status() {
	jail=$1
	if ! ( check_jail $jail ); then
		echo "Jail $jail doesn't exist ! Use '$0 status' for list all" >&2
                exit 1
	fi

	inc=$(get_inc $jail)
	if ( check_jail_on $jail ); then
		status="ON "
	else
		status="OFF"
	fi
	port=$(get_port $jail)
	ip=$(get_ip $jail|xargs|tr -s ' ' ',')
	echo "$jail $status $port $inc $ip" | awk '{ printf("%- 30s %- 10s %- 10s %- 10s %- 40s\n", $1, $2, $3, $4, $5); }'
}

sub_params() {
	jail=$1
	params=$2
	option=$3
	if ! ( check_jail $jail ); then
                echo "Jail $jail doesn't exist ! Create it with '$0 init $jail'" >&2
                exit 1
        fi

	if [ -z "${option}" ]; then
	        get_${params} $jail
	else
	        set_${params} $jail $option
		echo "Update $jail : $params = $option"
	fi
}

sub_sync() {
	jail=$1
	if ! ( check_jail $jail ); then
                echo "Jail $jail doesn't exist !" >&2
                exit 1
        fi

	if [ -z "${NODE}" ]; then
		echo "You must define \$NODE in /etc/default/bkctld !" >&2
		exit 1
	fi
	jail=$1
	ssh $NODE bkctld init $jail >/dev/null
	rsync -a ${JAILDIR}/${jail}/ ${NODE}:${JAILDIR}/${jail}/ --exclude proc/* --exclude sys/* --exclude dev/* --exclude run --exclude var/backup/*
	rsync -a ${CONFDIR}/$jail ${NODE}:${CONFDIR}/$jail
	if ( check_jail_on $jail ); then
		ssh $NODE bkctld start $jail >/dev/null
	fi
	if [ -n "${FIREWALL_RULES}" ]; then
		rsync -a ${FIREWALL_RULES} ${NODE}:${FIREWALL_RULES}
		ssh $NODE /etc/init.d/minifirewall restart >/dev/null
	fi
}

sub_inc() {
	date=$(date +"%Y-%m-%d-%H")
	incs_logs=""
	jails=$(ls $JAILDIR)
	for jail in $jails; do
		inc="${INCDIR}/${jail}/${date}"
		mkdir -p ${INCDIR}/${jail}
		if [ ! -d "${inc}" ]; then
			start=$(date +"%H:%M:%S")
			jail_inode=$(stat --format=%i ${JAILDIR}/${jail})
			if [ "$jail_inode" -eq 256 ]; then
				$BTRFS subvolume snapshot -r ${JAILDIR}/${jail} $inc > /dev/null
			else
				cp -alx ${JAILDIR}/${jail}/ $inc
			fi
			end=$(date +"%H:%M:%S")
			inc_log="Create $date inc of $jail (Start at $start / End at $end)"
			echo "${inc_log}"
			incs_logs="${incs_logs} ${inc_log}"
		else
			echo "Inc $date of $jail already exist !" >&2
		fi
	done
	if [ -n "${NOTIF_MAIL}" ]; then
		if [ -n "${incs_logs}" ]; then
			echo "${incs_logs}" | mail -s "[info] EvoBackup - create incs" $NOTIF_MAIL
		fi
	fi
}

sub_rm() {
	empty="/tmp/bkctld-${$}-$(date +%N))"
	mkdir $empty
	pidfile="/var/run/bkctld-rm.pid"
	if [ -f "${pidfile}" ]; then
		pid=$(cat $pidfile)
		ps -u $pid >/dev/null
		if [ $? -eq 0 ]; then
			echo "$0 rm always run (PID $pid) !" >&2
			kill -9 $pid
			rm $pidfile
			if [ -n "${NOTIF_MAIL}" ]; then
			        echo "$0 rm $pid was killed by $$ !" | mail -s "[warn] EvoBackup - purge incs interrupted" $NOTIF_MAIL
			fi
		else
			rm $pidfile
		fi
        fi
	echo $$ > $pidfile
	rms_logs=""
	jails=$(ls $JAILDIR)
	for jail in $jails; do
		incs=$(ls ${INCDIR}/$jail)
		if [ -f ${CONFDIR}/$jail ]; then
			keepfile="${CONFDIR}/.keep-${jail}"
			while read j; do
			        date=$( echo "$j" | cut -d. -f1 )
			        before=$( echo "$j" | cut -d. -f2 )
				date -d "$(date "$date") $before" "+%Y-%m-%d"
			done < "${CONFDIR}/$jail" > "$keepfile"
			for j in $(echo "${incs}" | grep -v -f "$keepfile"); do
				start=$(date +"%H:%M:%S")
				inc_inode=$(stat --format=%i "${INCDIR}/${jail}/${j}")
				if [ "$inc_inode" -eq 256 ]; then
				        $BTRFS subvolume delete "${INCDIR}/${jail}/${j}" >/dev/null
				else
				        cd "${INCDIR}/$jail"
				        rsync -a --delete "$empty/" "$j/"
				        rmdir "$j"
				fi
				end=$(date +"%H:%M:%S")
				rm_log="Delete $j inc of $jail (Start at $start / End at $end)"
				echo "${rm_log}"
				rms_logs="${rms_logs} ${rm_log}"
			done
		fi
	done
	rmdir $empty
	rm $pidfile
	if [ -n "${NOTIF_MAIL}" ]; then
		if [ -n "${rms_logs}" ]; then
	                echo "${rms_logs}" | mail -s "[info] EvoBackup - purge incs" $NOTIF_MAIL
		fi
        fi
}

## log function

log() {
	subcommand=$1
	logfile="${LOG_DIR}/bkctld.log"
        shift
        tty -s
        if [ $? -eq 0 ]; then
                sub_${subcommand} "$@" 2>&1 | tee -a $logfile
        else
                sub_${subcommand} "$@" >> $logfile 2>&1
        fi	
}

## main function : check usage and valid params

main() {
	if [ "$(id -u)" -ne 0 ]; then
	    echo "Error, you need to be root to run $0 !" >&2
	    exit 1
	fi
	[ -f /etc/default/bkctld ] && . /etc/default/bkctld
	[ -z "${CONFDIR}" ] && CONFDIR='/etc/evobackup'
	[ -z "${JAILDIR}" ] && JAILDIR='/backup/jails'
	[ -z "${INCDIR}" ] && INCDIR='/backup/incs'
	[ -z "${TPLDIR}" ] && TPLDIR='/usr/share/bkctld'
	[ -z "${LOCALTPLDIR}" ] && LOCALTPLDIR='/usr/local/share/bkctld'
	[ -z "${LOG_DIR}" ] && LOG_DIR='/var/log'
	[ -z "${SSHD_PID}" ] && SSHD_PID='/run/sshd.pid'
	[ -z "${SSHD_CONFIG}" ] && SSHD_CONFIG='/etc/ssh/sshd_config'
	[ -z "${AUTHORIZED_KEYS}" ] && AUTHORIZED_KEYS='/root/.ssh/authorized_keys'
	BTRFS=$(which btrfs)
	mkdir -p $CONFDIR $JAILDIR $INCDIR
	subcommand=$1
	jail=$2
	option=$3
	case $subcommand in
	    "" | "-h" | "--help")
	        usage
	        ;;
	    "inc" | "rm")
		log $subcommand
		;;
            "init")
		if [ -n "${jail}" ]; then
			log $subcommand $jail
		else
			usage
		fi
		;;
	    "key" | "port" | "ip")
		if [ -n "${jail}" ]; then
			log params $jail $subcommand $option
		else
			usage
		fi
		;;
	    "start" | "stop" | "reload" | "restart" | "sync" | "update" | "remove")
		if [ -n "${jail}" ]; then
			if [ "${jail}" = "all" ]; then
				jails=$(ls $JAILDIR)
				for jail in $jails; do
					case $subcommand in
					    "start")
						if ! ( check_jail_on $jail ); then
							log $subcommand $jail
						fi
						;;
					    "stop" | "reload")
						if ( check_jail_on $jail ); then
							log $subcommand $jail
						fi
						;;
					    "restart")
						if ( check_jail_on $jail ); then
							log stop $jail
	                                        fi
						log start $jail
						;;
					    *)
							log $subcommand $jail
						;;
					esac
		                done
			else
				if [ "${subcommand}" != "restart" ]; then
					log $subcommand $jail
				else
					if ( check_jail_on $jail ); then
						log stop $jail
					fi
					log start $jail
				fi
			fi
		else
			usage
		fi
		;;
	    "status")
		if [ -z "${jail}" ]; then
			jails=$(ls $JAILDIR)
			for jail in $jails; do
	                        sub_$subcommand $jail
	                done
		else
			sub_$subcommand $jail
		fi
		;;
	    *)
	        shift
	        echo "Error: '${subcommand}' is not a known subcommand." >&2
		usage
	       	exit 1
	        ;;
	esac
}

main "$@"