404 lines
10 KiB
Bash
Executable file
404 lines
10 KiB
Bash
Executable file
#!/bin/bash
|
|
#
|
|
# bkctl is a shell script to create and manage a backup server which will
|
|
# handle the backup of many servers (clients).
|
|
|
|
id=$(id -u)
|
|
if [ $id != 0 ]; then
|
|
echo "Error, you need to be root to run bkctl !" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ -f /etc/default/evobackup ]; then
|
|
source /etc/default/evobackup
|
|
else
|
|
echo "Error, you need /etc/default/evobackup !" >&2
|
|
exit 1
|
|
fi
|
|
|
|
sub_help(){
|
|
echo "Usage: bkctl <subcommand> [options]"
|
|
echo "Subcommands:"
|
|
echo " init <jailname>"
|
|
echo " start <jailname>"
|
|
echo " stop <jailname>"
|
|
echo " reload <jailname>"
|
|
echo " restart <jailname>"
|
|
echo " status [<jailname>]"
|
|
echo " key <jailname> [<keyfile>]"
|
|
echo " port <jailname> [<ssh_port>]"
|
|
echo " ip <jailname> [<ip>]"
|
|
echo " inc"
|
|
echo " rm"
|
|
echo ""
|
|
echo "For help with each subcommand run:"
|
|
echo "bkctl <subcommand> -h|--help"
|
|
echo ""
|
|
}
|
|
|
|
sub_init() {
|
|
jail=$1
|
|
mkdir -p ${JAILDIR}/${jail}
|
|
umask 022
|
|
|
|
echo -n "1 - Creating the chroot..."
|
|
mkdir -p ${JAILDIR}/${jail}/{bin,dev,etc/ssh,lib,lib64,proc}
|
|
mkdir -p ${JAILDIR}/${jail}/lib/{x86_64-linux-gnu,tls/i686/cmov,i686/cmov}
|
|
mkdir -p ${JAILDIR}/${jail}/usr/{bin,lib,sbin}
|
|
mkdir -p ${JAILDIR}/${jail}/usr/lib/{x86_64-linux-gnu,openssh,i686/cmov}
|
|
mkdir -p ${JAILDIR}/${jail}/root/.ssh && chmod 700 ${JAILDIR}/${jail}/root/.ssh
|
|
mkdir -p ${JAILDIR}/${jail}/var/{log,run/sshd}
|
|
touch ${JAILDIR}/${jail}/var/log/{authlog,lastlog,messages,syslog}
|
|
touch ${JAILDIR}/${jail}/etc/fstab
|
|
echo "...OK"
|
|
|
|
echo -n "2 - Copying essential files..."
|
|
cp /proc/devices ${JAILDIR}/${jail}/proc
|
|
cp /etc/ssh/{ssh_host_rsa_key,ssh_host_dsa_key} ${JAILDIR}/${jail}/etc/ssh/
|
|
cp ${TPLDIR}/{passwd,shadow,group} ${JAILDIR}/${jail}/etc/
|
|
if [ ! -f ${JAILDIR}/$jail/${SSHD_CONFIG} ]; then
|
|
cp ${TPLDIR}/sshd_config ${JAILDIR}/$jail/${SSHD_CONFIG}
|
|
fi
|
|
echo "...OK"
|
|
|
|
echo -n "3 - Copying binaries..."
|
|
cp -f /lib/ld-linux.so.2 ${JAILDIR}/${jail}/lib/ 2>/dev/null || cp -f /lib64/ld-linux-x86-64.so.2 ${JAILDIR}/${jail}/lib64/
|
|
cp /lib/x86_64-linux-gnu/libnss* ${JAILDIR}/${jail}/lib/x86_64-linux-gnu/
|
|
|
|
for dbin in /bin/bash /bin/cat /bin/chown /bin/mknod /bin/rm /bin/ls /bin/sed /bin/sh /bin/uname /bin/mount /usr/bin/rsync /usr/sbin/sshd /usr/lib/openssh/sftp-server; do
|
|
cp -f $dbin ${JAILDIR}/${jail}/$dbin;
|
|
for lib in $(ldd $dbin | grep -Eo "/.*so.[0-9\.]+"); do
|
|
cp -p $lib ${JAILDIR}/${jail}/$lib
|
|
done
|
|
done
|
|
echo "...OK"
|
|
|
|
if [ ! -f ${CONFDIR}/$jail ]; then
|
|
install -m 0640 -v ${TPLDIR}/inc.tpl ${CONFDIR}/$jail
|
|
fi
|
|
}
|
|
|
|
sub_start() {
|
|
set -e
|
|
jail=$1
|
|
check_jail $jail
|
|
status=$(check_jail_on $jail)
|
|
if [ $status == "ON" ]; then
|
|
echo "Jail $jail already running !" >&2
|
|
exit 1
|
|
fi
|
|
mount -t proc proc-chroot ${JAILDIR}/${jail}/proc/
|
|
mount -nt tmpfs none ${JAILDIR}/${jail}/dev
|
|
mknod -m 622 ${JAILDIR}/${jail}/dev/console c 5 1
|
|
mknod -m 666 ${JAILDIR}/${jail}/dev/null c 1 3
|
|
mknod -m 666 ${JAILDIR}/${jail}/dev/zero c 1 5
|
|
mknod -m 666 ${JAILDIR}/${jail}/dev/ptmx c 5 2
|
|
mknod -m 666 ${JAILDIR}/${jail}/dev/tty c 5 0
|
|
mknod -m 444 ${JAILDIR}/${jail}/dev/random c 1 8
|
|
mknod -m 444 ${JAILDIR}/${jail}/dev/urandom c 1 9
|
|
chown root:tty ${JAILDIR}/${jail}/dev/{console,ptmx,tty}
|
|
ln -s ${JAILDIR}/${jail}/proc/self/fd ${JAILDIR}/${jail}/dev/fd
|
|
ln -s ${JAILDIR}/${jail}/proc/self/fd/0 ${JAILDIR}/${jail}/dev/stdin
|
|
ln -s ${JAILDIR}/${jail}/proc/self/fd/1 ${JAILDIR}/${jail}/dev/stdout
|
|
ln -s ${JAILDIR}/${jail}/proc/self/fd/2 ${JAILDIR}/${jail}/dev/stderr
|
|
ln -s ${JAILDIR}/${jail}/proc/kcore ${JAILDIR}/${jail}/dev/core
|
|
mkdir ${JAILDIR}/${jail}/dev/pts
|
|
mkdir ${JAILDIR}/${jail}/dev/shm
|
|
mount -t devpts -o gid=4,mode=620 none ${JAILDIR}/${jail}/dev/pts
|
|
mount -t tmpfs none ${JAILDIR}/${jail}/dev/shm
|
|
exec chroot ${JAILDIR}/${jail} /usr/sbin/sshd -E /var/log/authlog
|
|
}
|
|
|
|
sub_stop() {
|
|
set -e
|
|
jail=$1
|
|
check_jail $jail
|
|
status=$(check_jail_on $jail)
|
|
if [ $status == "OFF" ]; then
|
|
echo "Jail $jail is not running !" >&2
|
|
exit 1
|
|
fi
|
|
pid=$(cat ${JAILDIR}/${jail}/${SSHD_PID})
|
|
for conn in $(ps --ppid $pid -o pid=); do
|
|
kill $conn
|
|
done
|
|
kill $pid
|
|
umount ${JAILDIR}/${jail}/proc/
|
|
umount ${JAILDIR}/${jail}/dev/pts
|
|
umount ${JAILDIR}/${jail}/dev/shm
|
|
sleep 0.2
|
|
umount ${JAILDIR}/${jail}/dev/
|
|
}
|
|
|
|
sub_reload() {
|
|
set -e
|
|
jail=$1
|
|
check_jail $jail
|
|
status=$(check_jail_on $jail)
|
|
if [ $status == "ON" ]; then
|
|
pkill -HUP -F ${JAILDIR}/${jail}/${SSHD_PID}
|
|
fi
|
|
}
|
|
|
|
sub_restart() {
|
|
set -e
|
|
jail=$1
|
|
check_jail $jail
|
|
$0 stop $jail
|
|
$0 start $jail
|
|
}
|
|
|
|
sub_key() {
|
|
set -e
|
|
jail=$1
|
|
keyfile=$2
|
|
check_jail $jail
|
|
if [ -n "$keyfile" ]; then
|
|
set_key $jail $keyfile
|
|
else
|
|
get_key $jail
|
|
fi
|
|
}
|
|
|
|
sub_port() {
|
|
set -e
|
|
jail=$1
|
|
port=$2
|
|
check_jail $jail
|
|
pre_port=$(get_port $jail)
|
|
if [ -z $port ]; then
|
|
echo "$pre_port"
|
|
else
|
|
set_port $jail $port
|
|
$0 reload $jail
|
|
fi
|
|
}
|
|
|
|
sub_ip() {
|
|
set -e
|
|
jail=$1
|
|
ip=$2
|
|
check_jail $jail
|
|
pre_ip=$(get_ip $jail)
|
|
if [ -z $ip ]; then
|
|
echo "$pre_ip"
|
|
else
|
|
set_ip $jail $ip
|
|
$0 reload $jail
|
|
fi
|
|
}
|
|
|
|
sub_status() {
|
|
set -e
|
|
jail=$1
|
|
check_jail $jail
|
|
inc=$(check_inc $jail)
|
|
status=$(check_jail_on $jail)
|
|
port=$(get_port $jail)
|
|
ip=$(get_ip $jail|xargs)
|
|
echo "$jail $status $port $inc $ip"
|
|
}
|
|
|
|
sub_inc() {
|
|
date=$(date +"%Y-%m-%d-%H")
|
|
for jail in $(ls -1 $CONFDIR); do
|
|
echo -n "hard copy $jail begins at : " >> $LOGFILE
|
|
/bin/date +"%d-%m-%Y ; %H:%M" >> $LOGFILE
|
|
mkdir -p ${INCDIR}${jail}
|
|
cp -alx ${JAILDIR}/${jail}/ ${INCDIR}${jail}/$date
|
|
echo -n "hard copy $i ends at : " >> $LOGFILE
|
|
/bin/date +"%d-%m-%Y ; %H:%M" >> $LOGFILE
|
|
done #| tee -a $LOGFILE | mail -s "[info] EvoBackup - create incs" $MYMAIL
|
|
}
|
|
|
|
sub_rm() {
|
|
for i in $( ls -1 $CONFDIR ); do
|
|
# list actual inc backups
|
|
for j in $( ls $INCDIR$i ); do
|
|
echo $j
|
|
done > "$TMPDIR"$i.files
|
|
|
|
# list non-obsolete inc backups
|
|
for j in $( cat $CONFDIR$i ); do
|
|
date=$( echo $j | cut -d. -f1 )
|
|
before=$( echo $j | cut -d. -f2 )
|
|
date -d "$(date $date) $before" "+%Y-%m-%d"
|
|
done > "$TMPDIR"$i.keep
|
|
|
|
# delete obsolete inc backups
|
|
for j in $( grep -v -f "$TMPDIR"$i.keep "$TMPDIR"$i.files ); do
|
|
echo -n "Delete $i/$j begins at : " >> $LOGFILE
|
|
/bin/date +"%d-%m-%Y ; %H:%M" >> $LOGFILE
|
|
cd $INCDIR$i
|
|
[ -n "$j" ] && rsync -a --delete $EMPTYDIR/ $j*
|
|
[ -n "$j" ] && rmdir $j* && touch /tmp/evobackup-rm.txt
|
|
echo -n "Delete $i/$j ends at : " >> $LOGFILE
|
|
/bin/date +"%d-%m-%Y ; %H:%M" >> $LOGFILE
|
|
done
|
|
done #| tee -a $LOGFILE | ( [ -e "/tmp/evobackup-rm.txt" ] && mail -s "[info] EvoBackup - purge incs" $MYMAIL && rm /tmp/evobackup-rm.txt )
|
|
rm -rf $TMPDIR $EMPTYDIR
|
|
}
|
|
|
|
check_jail() {
|
|
jail=$1
|
|
if [ ! -d ${JAILDIR}/${jail} ]; then
|
|
echo "$jail doesn't exits !" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
check_jail_on() {
|
|
jail=$1
|
|
status="OFF"
|
|
if [ -f ${JAILDIR}/${jail}/${SSHD_PID} ]; then
|
|
pid=$(cat ${JAILDIR}/${jail}/${SSHD_PID})
|
|
ps -p $pid > /dev/null
|
|
if [ $? == 0 ]; then
|
|
status="ON"
|
|
else
|
|
rm ${JAILDIR}/${jail}/${SSHD_PID}
|
|
fi
|
|
fi
|
|
echo $status
|
|
}
|
|
|
|
check_inc() {
|
|
jail=$1
|
|
inc="0"
|
|
if [ -f ${CONFDIR}/${jail} ]; then
|
|
day=$(grep -c "day" ${CONFDIR}/${jail})
|
|
month=$(grep -c "month" ${CONFDIR}/${jail})
|
|
inc="${day}/${month}"
|
|
fi
|
|
echo $inc
|
|
}
|
|
|
|
get_port() {
|
|
jail=$1
|
|
port=$(grep -E "Port [0-9]+" ${JAILDIR}/${jail}/${SSHD_CONFIG}|grep -oE "[0-9]+")
|
|
echo $port
|
|
}
|
|
|
|
set_port() {
|
|
jail=$1
|
|
port=$2
|
|
if [ "$port" = "auto" ]; then
|
|
port=$(grep -h Port ${JAILDIR}/*/${SSHD_CONFIG} 2>/dev/null | grep -Eo [0-9]+ | sort -n | tail -1)
|
|
port=$((port+1))
|
|
if [ ! $port -gt 1 ]; then
|
|
port=2222
|
|
fi
|
|
fi
|
|
sed -i "s/^Port .*/Port ${port}/" ${JAILDIR}/$jail/${SSHD_CONFIG}
|
|
set_firewall $jail
|
|
}
|
|
|
|
get_key() {
|
|
jail=$1
|
|
if [ -f ${JAILDIR}/${jail}/${AUTHORIZED_KEYS} ]; then
|
|
cat ${JAILDIR}/${jail}/${AUTHORIZED_KEYS}
|
|
fi
|
|
}
|
|
|
|
set_key() {
|
|
jail=$1
|
|
keyfile=$2
|
|
if [ -f $keyfile ]; then
|
|
cat $keyfile > ${JAILDIR}/${jail}/${AUTHORIZED_KEYS}
|
|
chmod 600 ${JAILDIR}/${jail}/${AUTHORIZED_KEYS}
|
|
else
|
|
echo "Keyfile $keyfile dosen't exist !" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
get_ip() {
|
|
jail=$1
|
|
for allow in $(grep -E "^AllowUsers" ${JAILDIR}/$jail/${SSHD_CONFIG}|grep -Eo "root@[^ ]+"); do
|
|
echo $allow|cut -d'@' -f2
|
|
done
|
|
}
|
|
|
|
set_ip() {
|
|
jail=$1
|
|
ip=$2
|
|
if [ $ip = "all" ]; then
|
|
ips="0.0.0.0/0"
|
|
else
|
|
ips=$(get_ip $jail)
|
|
ips=$(echo $ips $ip|xargs -n1|grep -v "0.0.0.0/0"|sort|uniq)
|
|
fi
|
|
allow="AllowUsers"
|
|
for ip in $ips; do
|
|
allow="$allow root@${ip}"
|
|
done
|
|
sed -i "s~^AllowUsers .*~${allow}~" ${JAILDIR}/$jail/${SSHD_CONFIG}
|
|
set_firewall $jail
|
|
}
|
|
|
|
set_firewall() {
|
|
jail=$1
|
|
if [ -f $FIREWALL_RULES ]; then
|
|
sed -i "/#${jail}$/d" $FIREWALL_RULES
|
|
fi
|
|
port=$(get_port $jail)
|
|
for ip in $(get_ip $jail); do
|
|
echo "/sbin/iptables -A INPUT -p tcp --sport 1024: --dport $port -s $ip -j ACCEPT #$jail" >> $FIREWALL_RULES
|
|
done
|
|
}
|
|
|
|
main() {
|
|
mkdir -p $CONFDIR $JAILDIR $INCDIR
|
|
subcommand=$1
|
|
jail=$2
|
|
option=$3
|
|
case $subcommand in
|
|
"" | "-h" | "--help")
|
|
sub_help
|
|
;;
|
|
"inc" | "rm")
|
|
pkill -f /run/bkctl.pid #| mail -s "[warn] EvoBackup - purge incs interrupted" $MYMAIL
|
|
rm -f /run/bkctl.pid
|
|
sub_${subcommand} $jail &
|
|
echo $! > /run/bkctl.pid
|
|
;;
|
|
"init" | "key" | "port" | "ip")
|
|
if [ -z $jail ]; then
|
|
sub_help
|
|
exit 1
|
|
fi
|
|
sub_${subcommand} $jail $option
|
|
;;
|
|
"start" | "stop" | "reload" | "restart")
|
|
if [ -z $jail ]; then
|
|
sub_help
|
|
exit 1
|
|
fi
|
|
if [ $jail = "all" ]; then
|
|
for jail in $(ls $JAILDIR); do
|
|
$0 ${subcommand} $jail
|
|
done
|
|
else
|
|
sub_${subcommand} $jail
|
|
fi
|
|
;;
|
|
"status")
|
|
if [ -z $jail ]; then
|
|
for jail in $(ls $JAILDIR); do
|
|
$0 status $jail
|
|
done
|
|
else
|
|
sub_${subcommand} $jail
|
|
fi
|
|
;;
|
|
*)
|
|
shift
|
|
echo "Error: '$subcommand' is not a known subcommand." >&2
|
|
sub_help
|
|
exit 1
|
|
;;
|
|
esac
|
|
}
|
|
|
|
main "$@"
|