459 lines
12 KiB
Bash
Executable file
459 lines
12 KiB
Bash
Executable file
#!/bin/bash
|
|
#
|
|
# bkctld is a shell script to create and manage a backup server which will
|
|
# handle the backup of many servers (clients).
|
|
|
|
id=$(id -u)
|
|
if [ $id != 0 ]; then
|
|
echo "Error, you need to be root to run bkctld !" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ -f /etc/default/evobackup ]; then
|
|
source /etc/default/evobackup
|
|
else
|
|
echo "Error, you need /etc/default/evobackup !" >&2
|
|
exit 1
|
|
fi
|
|
|
|
sub_help(){
|
|
echo "Usage: $0 <subcommand> [options]"
|
|
echo "Subcommands:"
|
|
echo " init <jailname> Init jail <jailname>"
|
|
echo " update (<jailname>|all) Update jail <jailname> or all"
|
|
echo " remove (<jailname>|all) Remove jail <jailname> or all"
|
|
echo " start (<jailname>|all) Start jail <jailname> or all"
|
|
echo " stop (<jailname>|all) Stop jail <jailname> or all"
|
|
echo " reload (<jailname>|all) Reload jail <jailname> or all"
|
|
echo " restart (<jailname>|all) Restart jail <jailname> or all"
|
|
echo " sync (<jailname>|all) Sync jail <jailname> or all to another node"
|
|
echo " status [<jailname>] Print status of <jailname> (default all jail)"
|
|
echo " key <jailname> [<keyfile>] Set or get ssh pubic key of <jailname>"
|
|
echo " port <jailname> [(<ssh_port>|auto)] Set or get ssh port of <jailname>"
|
|
echo " ip <jailname> [(<ip>|all)] Set or get allowed(s) ip(s) of <jailname>"
|
|
echo " inc Make incremental inc of all jails"
|
|
echo " rm Remove old incremtal inc of all jails"
|
|
echo ""
|
|
}
|
|
|
|
sub_init() {
|
|
jail=$1
|
|
if ( check_btrfs); then
|
|
btrfs subvolume create ${JAILDIR}/${jail}
|
|
else
|
|
mkdir -p ${JAILDIR}/${jail}
|
|
fi
|
|
mk_jail $jail
|
|
echo -n "4 - Copie default sshd_config..."
|
|
install -m 0640 ${TPLDIR}/sshd_config ${JAILDIR}/$jail/${SSHD_CONFIG}
|
|
echo "...OK"
|
|
echo -n "5 - Set usable sshd port..."
|
|
set_port $jail auto
|
|
echo "...OK"
|
|
echo -n "6 - Copie default inc configuration..."
|
|
install -m 0640 ${TPLDIR}/inc.tpl ${CONFDIR}/$jail
|
|
echo "...OK"
|
|
}
|
|
|
|
sub_update() {
|
|
jail=$1
|
|
status=$(check_jail_on $jail)
|
|
if ( $status ); then
|
|
$0 stop $jail
|
|
fi
|
|
mk_jail $jail
|
|
if ( $status ); then
|
|
$0 start $jail
|
|
fi
|
|
}
|
|
|
|
sub_remove() {
|
|
jail=$1
|
|
if ( check_jail_on $jail ); then
|
|
$0 stop $jail
|
|
fi
|
|
if ( check_btrfs ); then
|
|
btrfs subvolume delete ${JAILDIR}/${jail}
|
|
rm -f ${CONFDIR}/${jail}
|
|
if [ -d ${INCDIR}/${jail} ]; then
|
|
btrfs subvolume delete ${INCDIR}/${jail}/*
|
|
rmdir ${INCDIR}/${jail}
|
|
fi
|
|
else
|
|
rm -rf ${JAILDIR}/${jail}
|
|
rm -f ${CONFDIR}/${jail}
|
|
rm -rf ${INCDIR}/${jail}
|
|
fi
|
|
}
|
|
|
|
sub_start() {
|
|
jail=$1
|
|
if ( $(check_jail_on $jail) ); then
|
|
echo "Jail $jail already running !" >&2
|
|
exit 1
|
|
fi
|
|
mount -t proc bkctld-proc-${jail} ${JAILDIR}/${jail}/proc/
|
|
mount -nt tmpfs bkctld-dev-${jail} ${JAILDIR}/${jail}/dev
|
|
mknod -m 622 ${JAILDIR}/${jail}/dev/console c 5 1
|
|
mknod -m 666 ${JAILDIR}/${jail}/dev/null c 1 3
|
|
mknod -m 666 ${JAILDIR}/${jail}/dev/zero c 1 5
|
|
mknod -m 666 ${JAILDIR}/${jail}/dev/ptmx c 5 2
|
|
mknod -m 666 ${JAILDIR}/${jail}/dev/tty c 5 0
|
|
mknod -m 444 ${JAILDIR}/${jail}/dev/random c 1 8
|
|
mknod -m 444 ${JAILDIR}/${jail}/dev/urandom c 1 9
|
|
chown root:tty ${JAILDIR}/${jail}/dev/{console,ptmx,tty}
|
|
ln -s ${JAILDIR}/${jail}/proc/self/fd ${JAILDIR}/${jail}/dev/fd
|
|
ln -s ${JAILDIR}/${jail}/proc/self/fd/0 ${JAILDIR}/${jail}/dev/stdin
|
|
ln -s ${JAILDIR}/${jail}/proc/self/fd/1 ${JAILDIR}/${jail}/dev/stdout
|
|
ln -s ${JAILDIR}/${jail}/proc/self/fd/2 ${JAILDIR}/${jail}/dev/stderr
|
|
ln -s ${JAILDIR}/${jail}/proc/kcore ${JAILDIR}/${jail}/dev/core
|
|
mkdir ${JAILDIR}/${jail}/dev/pts
|
|
mkdir ${JAILDIR}/${jail}/dev/shm
|
|
mount -t devpts -o gid=4,mode=620 none ${JAILDIR}/${jail}/dev/pts
|
|
mount -t tmpfs none ${JAILDIR}/${jail}/dev/shm
|
|
chroot ${JAILDIR}/${jail} /usr/sbin/sshd -D &
|
|
#umount -R ${JAILDIR}/${jail}/dev
|
|
#umount ${JAILDIR}/${jail}/proc/
|
|
}
|
|
|
|
sub_stop() {
|
|
jail=$1
|
|
if ( ! $(check_jail_on $jail) ); then
|
|
echo "Jail $jail is not running !" >&2
|
|
exit 1
|
|
fi
|
|
pid=$(cat ${JAILDIR}/${jail}/${SSHD_PID})
|
|
for conn in $(ps --ppid $pid -o pid=); do
|
|
kill $conn
|
|
done
|
|
kill $pid
|
|
umount -R ${JAILDIR}/${jail}/dev
|
|
umount ${JAILDIR}/${jail}/proc/
|
|
}
|
|
|
|
sub_reload() {
|
|
jail=$1
|
|
if [ $(check_jail_on $jail) ]; then
|
|
pkill -HUP -F ${JAILDIR}/${jail}/${SSHD_PID}
|
|
fi
|
|
}
|
|
|
|
sub_restart() {
|
|
set -e
|
|
jail=$1
|
|
$0 stop $jail
|
|
$0 start $jail
|
|
}
|
|
|
|
sub_status() {
|
|
jail=$1
|
|
inc=$(check_inc $jail)
|
|
if ($(check_jail_on $jail)); then
|
|
status="ON "
|
|
else
|
|
status="OFF"
|
|
fi
|
|
port=$(get_port $jail)
|
|
ip=$(get_ip $jail|xargs)
|
|
echo "$jail $status $port $inc $ip"
|
|
}
|
|
|
|
sub_sync() {
|
|
if [ -z $NODE ]; then
|
|
echo "You must define \$NODE in /etc/default/evobackup !" >&2
|
|
exit 1
|
|
fi
|
|
jail=$1
|
|
port=$(get_port $jail)
|
|
key=$(get_key $jail)
|
|
rsync -a ${CONFDIR}/$jail $NODE:${CONFDIR}/$jail
|
|
bkctld key $jail > /tmp/evobackup-${jail}.pub
|
|
rsync -a /tmp/evobackup-${jail}.pub $NODE:/tmp/evobackup-${jail}.pub
|
|
ssh $NODE bkctld init $jail
|
|
ssh $NODE bkctld port $jail $port
|
|
ssh $NODE bkctld key $jail /tmp/evobackup-${jail}.pub
|
|
for ip in $(get_ip $jail); do
|
|
ssh $NODE bkctld ip $jail $ip
|
|
done
|
|
}
|
|
|
|
sub_inc() {
|
|
date=$(date +"%Y-%m-%d-%H")
|
|
for jail in $(ls -1 $JAILDIR); do
|
|
inc="${INCDIR}/${jail}/${date}"
|
|
mkdir -p ${INCDIR}/${jail}
|
|
if [ ! -d "${inc}" ]; then
|
|
/bin/date +"%d-%m-%Y ; %H:%M" >> $LOGFILE
|
|
if ( check_btrfs ); then
|
|
btrfs subvolume snapshot ${JAILDIR}/$jail $inc >> $LOGFILE
|
|
else
|
|
echo -n "hard copy $jail begins at : " >> $LOGFILE
|
|
cp -alx ${JAILDIR}/${jail}/ ${INCDIR}${jail}/$date
|
|
echo -n "hard copy $JAIL ends at : " >> $LOGFILE
|
|
fi
|
|
/bin/date +"%d-%m-%Y ; %H:%M" >> $LOGFILE
|
|
fi
|
|
done
|
|
#| tee -a $LOGFILE | mail -s "[info] EvoBackup - create incs" $MYMAIL
|
|
}
|
|
|
|
sub_rm() {
|
|
for i in $( ls -1 $CONFDIR ); do
|
|
# list actual inc backups
|
|
for j in $( ls $INCDIR$i ); do
|
|
echo $j
|
|
done > "$TMPDIR"$i.files
|
|
|
|
# list non-obsolete inc backups
|
|
for j in $( cat $CONFDIR$i ); do
|
|
date=$( echo $j | cut -d. -f1 )
|
|
before=$( echo $j | cut -d. -f2 )
|
|
date -d "$(date $date) $before" "+%Y-%m-%d"
|
|
done > "$TMPDIR"$i.keep
|
|
|
|
# delete obsolete inc backups
|
|
for j in $( grep -v -f "$TMPDIR"$i.keep "$TMPDIR"$i.files ); do
|
|
echo -n "Delete $i/$j begins at : " >> $LOGFILE
|
|
/bin/date +"%d-%m-%Y ; %H:%M" >> $LOGFILE
|
|
if ( check_btrfs ); then
|
|
[ -n "$j" ] && btrfs subvolume delete $INCDIR$i/$j && touch /tmp/evobackup-rm.txt
|
|
else
|
|
cd $INCDIR$i
|
|
[ -n "$j" ] && rsync -a --delete $EMPTYDIR/ $j*
|
|
[ -n "$j" ] && rmdir $j* && touch /tmp/evobackup-rm.txt
|
|
fi
|
|
echo -n "Delete $i/$j ends at : " >> $LOGFILE
|
|
/bin/date +"%d-%m-%Y ; %H:%M" >> $LOGFILE
|
|
done
|
|
done #| tee -a $LOGFILE | ( [ -e "/tmp/evobackup-rm.txt" ] && mail -s "[info] EvoBackup - purge incs" $MYMAIL && rm /tmp/evobackup-rm.txt )
|
|
rm -rf $TMPDIR $EMPTYDIR
|
|
}
|
|
|
|
mk_jail() {
|
|
jail=$1
|
|
umask 022
|
|
|
|
echo -n "1 - Creating the chroot..."
|
|
mkdir -p ${JAILDIR}/${jail}/{bin,dev,etc/ssh,lib,lib64,proc}
|
|
mkdir -p ${JAILDIR}/${jail}/lib/{x86_64-linux-gnu,tls/i686/cmov,i686/cmov}
|
|
mkdir -p ${JAILDIR}/${jail}/usr/{bin,lib,sbin}
|
|
mkdir -p ${JAILDIR}/${jail}/usr/lib/{x86_64-linux-gnu,openssh,i686/cmov}
|
|
mkdir -p ${JAILDIR}/${jail}/root/.ssh && chmod 700 ${JAILDIR}/${jail}/root/.ssh
|
|
mkdir -p ${JAILDIR}/${jail}/var/{log,run/sshd}
|
|
touch ${JAILDIR}/${jail}/var/log/{authlog,lastlog,messages,syslog}
|
|
touch ${JAILDIR}/${jail}/etc/fstab
|
|
echo "...OK"
|
|
|
|
echo -n "2 - Copying essential files..."
|
|
cp /proc/devices ${JAILDIR}/${jail}/proc
|
|
cp /etc/ssh/{ssh_host_rsa_key,ssh_host_dsa_key} ${JAILDIR}/${jail}/etc/ssh/
|
|
cp ${TPLDIR}/{passwd,shadow,group} ${JAILDIR}/${jail}/etc/
|
|
echo "...OK"
|
|
|
|
echo -n "3 - Copying binaries..."
|
|
cp -f /lib/ld-linux.so.2 ${JAILDIR}/${jail}/lib/ 2>/dev/null || cp -f /lib64/ld-linux-x86-64.so.2 ${JAILDIR}/${jail}/lib64/
|
|
cp /lib/x86_64-linux-gnu/libnss* ${JAILDIR}/${jail}/lib/x86_64-linux-gnu/
|
|
|
|
for dbin in /bin/bash /bin/cat /bin/chown /bin/mknod /bin/rm /bin/ls /bin/sed /bin/sh /bin/uname /bin/mount /usr/bin/rsync /usr/sbin/sshd /usr/lib/openssh/sftp-server; do
|
|
cp -f $dbin ${JAILDIR}/${jail}/$dbin;
|
|
for lib in $(ldd $dbin | grep -Eo "/.*so.[0-9\.]+"); do
|
|
cp -p $lib ${JAILDIR}/${jail}/$lib
|
|
done
|
|
done
|
|
echo "...OK"
|
|
}
|
|
|
|
check_jail() {
|
|
jail=$1
|
|
if [ -d ${JAILDIR}/${jail} ]; then
|
|
exit 0
|
|
else
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
check_jail_on() {
|
|
jail=$1
|
|
if [ -f ${JAILDIR}/${jail}/${SSHD_PID} ]; then
|
|
pid=$(cat ${JAILDIR}/${jail}/${SSHD_PID})
|
|
ps -p $pid > /dev/null
|
|
if [ $? == 0 ]; then
|
|
exit 0
|
|
else
|
|
rm ${JAILDIR}/${jail}/${SSHD_PID}
|
|
umount -R ${JAILDIR}/${jail}/dev
|
|
umount ${JAILDIR}/${jail}/proc/
|
|
exit 1
|
|
fi
|
|
else
|
|
exit 1
|
|
fi
|
|
echo $status
|
|
}
|
|
|
|
check_inc() {
|
|
jail=$1
|
|
inc="0"
|
|
if [ -f ${CONFDIR}/${jail} ]; then
|
|
day=$(grep -c "day" ${CONFDIR}/${jail})
|
|
month=$(grep -c "month" ${CONFDIR}/${jail})
|
|
inc="${day}/${month}"
|
|
fi
|
|
echo $inc
|
|
}
|
|
|
|
check_btrfs() {
|
|
grep $(dirname $JAILDIR) /etc/fstab|grep -q btrfs
|
|
if [[ $? -eq 0 ]]; then
|
|
exit 0
|
|
fi
|
|
grep $JAILDIR /etc/fstab|grep -q btrfs
|
|
if [[ $? -ne 0 ]]; then
|
|
exit 1
|
|
fi
|
|
grep $INCDIR /etc/fstab|grep -q btrfs
|
|
if [[ $? -ne 0 ]]; then
|
|
exit 1
|
|
fi
|
|
exit 0
|
|
}
|
|
|
|
get_port() {
|
|
jail=$1
|
|
port=$(grep -E "Port [0-9]+" ${JAILDIR}/${jail}/${SSHD_CONFIG}|grep -oE "[0-9]+")
|
|
echo $port
|
|
}
|
|
|
|
set_port() {
|
|
jail=$1
|
|
port=$2
|
|
if [ "$port" = "auto" ]; then
|
|
port=$(grep -h Port ${JAILDIR}/*/${SSHD_CONFIG} 2>/dev/null | grep -Eo [0-9]+ | sort -n | tail -1)
|
|
port=$((port+1))
|
|
if [ ! $port -gt 1 ]; then
|
|
port=2222
|
|
fi
|
|
fi
|
|
sed -i "s/^Port .*/Port ${port}/" ${JAILDIR}/$jail/${SSHD_CONFIG}
|
|
set_firewall $jail
|
|
}
|
|
|
|
get_key() {
|
|
jail=$1
|
|
if [ -f ${JAILDIR}/${jail}/${AUTHORIZED_KEYS} ]; then
|
|
cat ${JAILDIR}/${jail}/${AUTHORIZED_KEYS}
|
|
fi
|
|
}
|
|
|
|
set_key() {
|
|
jail=$1
|
|
keyfile=$2
|
|
if [ -f $keyfile ]; then
|
|
cat $keyfile > ${JAILDIR}/${jail}/${AUTHORIZED_KEYS}
|
|
chmod 600 ${JAILDIR}/${jail}/${AUTHORIZED_KEYS}
|
|
else
|
|
echo "Keyfile $keyfile dosen't exist !" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
get_ip() {
|
|
jail=$1
|
|
for allow in $(grep -E "^AllowUsers" ${JAILDIR}/$jail/${SSHD_CONFIG}|grep -Eo "root@[^ ]+"); do
|
|
echo $allow|cut -d'@' -f2
|
|
done
|
|
}
|
|
|
|
set_ip() {
|
|
jail=$1
|
|
ip=$2
|
|
if [[ $ip = "all" || $ip = "0.0.0.0/0" ]]; then
|
|
ips="0.0.0.0/0"
|
|
else
|
|
ips=$(get_ip $jail)
|
|
ips=$(echo $ips $ip|xargs -n1|grep -v "0.0.0.0/0"|sort|uniq)
|
|
fi
|
|
allow="AllowUsers"
|
|
for ip in $ips; do
|
|
allow="$allow root@${ip}"
|
|
done
|
|
sed -i "s~^AllowUsers .*~${allow}~" ${JAILDIR}/$jail/${SSHD_CONFIG}
|
|
set_firewall $jail
|
|
}
|
|
|
|
set_firewall() {
|
|
jail=$1
|
|
if [ -f $FIREWALL_RULES ]; then
|
|
sed -i "/#${jail}$/d" $FIREWALL_RULES
|
|
fi
|
|
port=$(get_port $jail)
|
|
for ip in $(get_ip $jail); do
|
|
echo "/sbin/iptables -A INPUT -p tcp --sport 1024: --dport $port -s $ip -j ACCEPT #$jail" >> $FIREWALL_RULES
|
|
done
|
|
}
|
|
|
|
main() {
|
|
mkdir -p $CONFDIR $JAILDIR $INCDIR
|
|
subcommand=$1
|
|
jail=$2
|
|
option=$3
|
|
case $subcommand in
|
|
"" | "-h" | "--help")
|
|
sub_help
|
|
;;
|
|
"inc" | "rm")
|
|
sub_${subcommand} $jail
|
|
;;
|
|
"init")
|
|
if [[ -n "${jail}" ]]; then
|
|
if ( ! $(check_jail $jail) ); then
|
|
sub_${subcommand} $jail
|
|
fi
|
|
fi
|
|
;;
|
|
"key" | "port" | "ip")
|
|
if [[ -n "${jail}" ]]; then
|
|
if ( $(check_jail $jail) ); then
|
|
if [ -z "${option}" ]; then
|
|
get_${subcommand} $jail
|
|
else
|
|
set_${subcommand} $jail $option
|
|
fi
|
|
fi
|
|
fi
|
|
;;
|
|
"start" | "stop" | "reload" | "restart" | "sync" | "update" | "remove")
|
|
if [[ -n "${jail}" ]]; then
|
|
if [[ "${jail}" = "all" ]]; then
|
|
for jail in $(ls $JAILDIR); do
|
|
$0 ${subcommand} $jail
|
|
done
|
|
else
|
|
if ( $(check_jail $jail) ); then
|
|
sub_${subcommand} $jail
|
|
fi
|
|
fi
|
|
fi
|
|
;;
|
|
"status")
|
|
if [[ -z "${jail}" ]]; then
|
|
for jail in $(ls $JAILDIR); do
|
|
$0 ${subcommand} $jail
|
|
done
|
|
else
|
|
if ( $(check_jail $jail) ); then
|
|
sub_${subcommand} $jail
|
|
fi
|
|
fi
|
|
;;
|
|
*)
|
|
shift
|
|
echo "Error: '$subcommand' is not a known subcommand." >&2
|
|
sub_help
|
|
exit 1
|
|
;;
|
|
esac
|
|
}
|
|
|
|
main "$@"
|