1SAFEKEEP(1)                     SafeKeep Manual                    SAFEKEEP(1)
2
3
4

NAME

6       safekeep - Client/server backup script
7

SYNOPSIS

9       safekeep --server [-q] [-v] [--noemail] [--force] [-c file] [--cleanup]
10       [--tempdir=<tempdir>] <clientid>*
11
12       safekeep --keys [-q] [-v] [--noemail] [-c file] [-i file] [--status]
13       [--print] [--deploy] <clientid>*
14
15       safekeep --list [-q] [-v] [--noemail] [-c file] [--increments]
16       [--parsable-output] [--sizes] [--changed=<time>] [--at-time=<time>]
17       <clientid>*
18
19       safekeep --client [--cleanup]
20
21       safekeep -h | -V
22

DESCRIPTION

24       SafeKeep is a client/server backup script which enhances the power of
25       rdiff-backup with simple configuration and use.
26
27       SafeKeep can work in server mode, client mode, SSH key management mode
28       or list mode.
29
30       In server mode, SafeKeep parses a set of configurations files which
31       defines a set of backup clients. For each backup client, SafeKeep
32       connects to the client host over SSH (using a public key
33       authentification system previously set up using safekeep --keys
34       --deploy), and launches safekeep --client onto the client host. The
35       client does the real backup and sends the data over SSH to the SafeKeep
36       server which stores it in the specified location.
37
38       In client mode, SafeKeep does a few setup steps, depending on the
39       client configuration (database dump, LVM device snapshot), then backups
40       the client data using rdiff-backup, and then cleanups the state
41       (removes the database dumps, deactivates the LVM snapshots)
42
43       Note that the client mode of SafeKeep should never be invoked manually,
44       this mode is meant to be used only by the server mode of SafeKeep. The
45       only exception to this is if run with the --cleanup option, which is
46       used to remove LVM snapshots and mounts created by Safekeep, after a
47       crash or some other failure, without a connection to the server.
48       Normally this cleanup would be performed through the server command
49       safekeep --server --cleanup.
50
51       The SSH key management mode is a helper mode for deploying or verifying
52       the setup of the SSH authentification keys.
53
54       In list mode, SafeKeep lists the details of existing archives. This is
55       basically an interface to the relevant options for rdiff-backup.
56
57       In server, keys management and list mode, you can restrict the
58       operation to a specific set of clients by listing the desired client
59       IDs as arguments. If no client ID is given, SafeKeep will operate over
60       all known clients.
61
62       Each mode accepts a few options as described below.
63

OPERATION MODE

65       --server
66           Selects the server mode
67
68       --client
69           Selects the client mode. This should never be invoked manually, the
70           clients are started automatically by the server on the client
71           machines using SSH.
72
73       --keys
74           Selects the SSH key management mode
75
76       --list
77           Selects the list mode
78       Please note that you must always specify an operation mode. Earlier
79       versions used do default to --server mode, but that proved to work out
80       poorly in practice.
81

GENERAL OPTIONS

83       -c, --conf=FILE
84           Specifies the configuration file location. If not specified at all,
85           SafeKeep will default to /etc/safekeep/safekeep.conf, or optionally
86           in ~/.safekeep/safekeep.conf for non-root users, if it exists.
87           Simply using this default is the recommended usage.
88
89       -h, --help
90           Selects the help mode, in which safekeep prints out the online help
91           and exits.
92
93       -V, --version
94           Selects the version mode, in which safekeep prints out the version
95           number and exits.
96
97       -q, --quiet
98           Decreases the verbosity level. Can be specified more than once.
99
100       -v, --verbose
101           Increases the verbosity level. Can be specified more than once.
102
103       --noemail
104           Disables the sending of email, no matter what the settings within
105           the configuration file.
106

SERVER OPTIONS

108       --force
109           Pass the --force option to rdiff-backup, allowing it to overwrite
110           the backup directory metadata. This option is potentially
111           dangerous, and should only be used if the backup directory becomes
112           corrupt, and rdiff-backup error logs tells you to use this option.
113
114       --cleanup
115           Remove LVM snapshots and mounts left by Safekeep after a crash or
116           other failure. This will run also run the standard cleanup
117           processes, such as the removal of an DB dumps, and forces a
118           consistency check of the rdiff-backup destination directory. This
119           is the prefered cleanup procedure and can be run with no danger of
120           corrupting the system if there is nothing to cleanup.
121
122       --tempdir TEMPDIR
123           Specifes a TEMPDIR for use with ‘rdiff-backup’. This overrides any
124           TEMPDIR specified in the ‘safekeep.conf’.
125

CLIENT OPTIONS

127       --cleanup
128           Remove LVM snapshots and mounts left after a crash or other failure
129           from the local system. Unlike the equivalent --server option, it
130           does not do any other of the standard cleanups. This option should
131           only be used when it is not possible to refer to the server, for
132           example, when the network connection to the server is no longer
133           available.
134

KEYS OPTIONS

136       -i FILE
137           Forces ssh(1) to use FILE for the identity (private key) in RSA/DSA
138           authentication. If not specified, ssh(1) will use its default
139           identity files.
140
141       --status
142           Display the key status for the clients. It is implied if no other
143           option is specified. In effect this option prints the steps that
144           will be taken when the keys are deployed to the client.
145
146       --print
147           Display the authorization keys for the clients. This is useful in
148           case you want to manually copy it into the client’s
149           ~/.ssh/authorized_keys file. This option is seldom useful.
150
151       --deploy
152           Deploy the authorization keys on the clients.
153

LIST OPTIONS

155       --increments
156           Pass the --list-increments option to rdiff-backup, to list the
157           number and date of partial incremental backups for the given or all
158           clients. This is the default list option.
159
160       --parseable-output
161           Pass the --parsable-output option to rdiff-backup to generate
162           output in a format that is easily parsed by other programs. This
163           currently only works with the --increments.
164
165       --sizes
166           Pass the --list-increment-sizes option to rdiff-backup, to list the
167           total size of all increment and mirror files by time for the given
168           or all clients. Note, this may take some time.
169
170       --changed=TIME
171           Pass the --list-changed-since option for TIME to rdiff-backup, to
172           list the files changed since TIME for the given clients. TIME is
173           passed directly to rdiff-backup. Note, this may take some time and
174           generate considerable output. Also, unlike rdiff-backup the is no
175           option to select sub-directories.
176
177       --at-time=TIME
178           Pass the --list-at-time option for TIME to rdiff-backup, to list
179           the files in the archive that were present at the given time for
180           the given clients. Note, this may take some time and generate
181           considerable output. Also, unlike rdiff-backup the is no option to
182           select sub-directories.
183

CONFIGURATION

185       Normally the configuration files are placed in the
186       /etc/safekeep/backup.d/ directory, or optionally in
187       ~/.safekeep/backup.d/ for non-root users, from where they will get
188       picked up automatically by SafeKeep. Each backup client is described by
189       a configuration file in XML format. The minimum configuration file is:
190
191
192           <backup>
193             <host name="my_workstation" />
194           </backup>
195
196       This will simply backup all relevant files (excluding temporary files,
197       caches, etc) from the client with the address my_workstation.
198
199       A more realistic example:
200
201
202           <backup>
203             <host name="my_workstation" />
204             <repo retention="10D" />
205             <setup>
206                 <dump type="postgres" dbuser="postgres" file="/var/lib/pgsql/backups/all_dbs" />
207                 <dump type="mysql" user="mysql" dbuser="dbbackup" db="adatabase" file="/var/backups/dumps/adatabase_dbs" />
208                 <dump type="mysql" user="mysql" dbuser="dbbackup" db="mysql" file="/var/backups/dumps/mysql_dbs" cleanup="true" />
209                 <snapshot device="/dev/mapper/VolGroup00-LogVol00" size="500M" />
210             </setup>
211
212             <data>
213               <exclude regexp=".*\.ogg"/>
214               <exclude regexp=".*\.mp3"/>
215
216               <include path="/etc"/>
217
218               <exclude glob="/home/*/tmp"/>
219               <include path="/home"/>
220
221               <include path="/root"/>
222
223               <include path="/srv"/>
224
225               <exclude path="/var/cache"/>
226               <exclude path="/var/lock"/>
227               <exclude path="/var/run"/>
228               <exclude path="/var/tmp"/>
229               <include path="/var/named/chroot/etc"/>
230               <include path="/var/named/chroot/var/named"/>
231               <exclude path="/var/named/chroot"/>
232               <include path="/var"/>
233
234               <exclude path="/"/>
235             </data>
236           </backup>
237
238       In this case, SafeKeep will dump all databases managed by PostgreSQL,
239       snapshot the disk via LVM, and proceed to backup /etc, /home, /root,
240       /srv, /var, while excluding some unneeded files and directories. Older
241       data will be retained for 10 days.
242
243       For full reference documentation of the configuration format, see
244       safekeep.backup(5).
245

CLIENT IDS

247       Normally the client IDs are generated automatically from the
248       configuration filenames without the extension. E.g. if a configuration
249       file is named my_workstation.conf, the client ID becomes
250       my_workstation. For more information on this topic, see
251       safekeep.backup(5).
252

KEY DEPLOYMENT

254       The safekeep(1) server needs to access the clients in order to conduct
255       the backup. To that end, it establishes two ssh(1) pipes: one for
256       control, and one for data. To simplify the deployment of the keys,
257       safekeep(1) has a key deploy mode.
258
259       When deploying keys using the built-in key management functionality,
260       safekeep(1) needs to be invoked as the user under which it will
261       function as a server. By default, that user is safekeep. For extra
262       security, you can not login into that account, so you have to invoke
263       safekeep(1) as root:
264
265
266                   [root@yourbox ~] # safekeep --keys --deploy
267

RESTORING

269       Since safekeep(1) is built around rdiff-backup(1), it doesn’t have any
270       built-in restore capabilities. It simply relies on rdiff-backup to
271       perform this task.
272
273       To do so, you just need to know the directory where the data is
274       actually stored. In a typical installation, for a box configured via
275       the file /etc/safekeep/backup.d/mybox.backup, the data will be stored
276       under /var/lib/safekeep/mybox/. Please refer to safekeep.backup(5) for
277       more information on this matter.
278
279       Once you have determined where the data will be stored (we’ll continue
280       the example above), all you have to do is run rdiff-backup:
281
282
283                   # rdiff-backup -r 1s /var/lib/safekeep/mybox my-restore-dir
284
285       You will be able to find more information on the restore procedure in
286       the rdiff-backup(1) man page.
287

FILE SELECTION

289       It is important to note that the include/exclude directives that
290       control file selection are matched in the order they appear in the
291       configuration file, and the first one that matches dictates whether the
292       file will be included or excluded. As a result, you have to add the
293       more specific ones first, or the more generic specifications will
294       always win. For example:
295
296
297           ...
298               <include path="/home"/>
299               <exclude path="/home/joe"/>
300           ...
301
302       will NOT do what you expect, because the /home will match before
303       /home/joe, and thus all files under /home will be included. The correct
304       way is to flip the two around
305
306
307           ...
308               <exclude path="/home/joe"/>
309               <include path="/home"/>
310           ...
311
312       Please see safekeep.backup(5) for more information on file selection.
313

SEE ALSO

315       rdiff-backup(1), safekeep.conf(5), safekeep.backup(5)
316

AUTHOR

318       Written by Dimi Paun <dimi@lattica.com[1]> and Stelian Pop
319       <stelian@lattica.com[2]>.
320

NOTES

322        1. dimi@lattica.com
323           mailto:dimi@lattica.com
324
325        2. stelian@lattica.com
326           mailto:stelian@lattica.com
327
328
329
330safekeep                          07/23/2021                       SAFEKEEP(1)
Impressum