One of my favorite backup tools has always been rsnapshot. It’s based off of rsync and uses a nice trick with hardlinks to maintain incremental updates that are also full updates. It runs using a basic configuration and a series of cron jobs. This is unix as it’s meant to be- extremely light weight while also being very powerful.
I am rather picky with how it is set up though. I don’t like leaving root open over ssh, which means a sudo based solution is needed on the client side. I’m also rather paranoid, which means I like my backup solutions to be read only. I also don’t like all of my machines running off of a single rsnapshot configuration, as this means a failure for the script to run on one means it won’t run on the ones after.
For years I had a set of scripts to handle this, but in the days of configuration management that seems almost silly. To make life easier I’ve put this all in a Puppet module.
There are quite a few features to this module that make it stand out-
- Client specific options instead of enforced globals. This module uses stand alone configurations for each host. Besides being more resilient to errors, this enables unique client settings- for instance, using different retain settings and backup times for different hosts.
-
Backup Point resource type for true Puppet style backup control. Rather than defining each backup point in the class file, the backup resource allows backups to be defined next to the profiles that need it.
-
Support for SSH without root access. In most cases root login is not available over ssh for security reasons, so this module relies instead on having its own unique user with restricted sudo access to give it the needed access to perform backups.
-
Support for automatic key sharing. The client machine will automatically receive the backup user’s ssh key from the server.
-
Locked down ssh accounts. SSH keys can only by used by the single backup host (locked down automatically by ip address), and is without access to unneeded features like x-forwarding. Commands allowed by the ssh key are limited to specific wrapper scripts installed by this module.
-
Sender only rsync. One of the biggest threats with rsync access is the potential to overwrite existing files on the system to gain unauthorized access. This module uses a wrapper script around rsync on the client side to make it a read only user.
The rsnapshot module is available on the Puppet Forge, and contributions are welcome at Github.