1SAFEKEEP(1) SafeKeep Manual SAFEKEEP(1)
2
6 safekeep - Client/server backup script
7
9 safekeep --server [-q] [-v] [--noemail] [--force] [-c file] [--cleanup]
10 [--tempdir=<tempdir>] <clientid>*
11 safekeep --keys [-q] [-v] [--noemail] [-c file] [-i file] [--status]
13 [--print] [--deploy] <clientid>*
14 safekeep --list [-q] [-v] [--noemail] [-c file] [--increments]
16 [--parsable-output] [--sizes] [--changed=<time>] [--at-time=<time>]
17 <clientid>*
18 safekeep --client [--cleanup]
20 safekeep -h | -V
22
24 SafeKeep is a client/server backup script which enhances the power of
25 rdiff-backup with simple configuration and use.
26 SafeKeep can work in server mode, client mode, SSH key management mode
28 or list mode.
29 In server mode, SafeKeep parses a set of configurations files which
31 defines a set of backup clients. For each backup client, SafeKeep
32 connects to the client host over SSH (using a public key
33 authentification system previously set up using safekeep --keys
34 --deploy), and launches safekeep --client onto the client host. The
35 client does the real backup and sends the data over SSH to the SafeKeep
36 server which stores it in the specified location.
37 In client mode, SafeKeep does a few setup steps, depending on the
39 client configuration (database dump, LVM device snapshot), then backups
40 the client data using rdiff-backup, and then cleanups the state
41 (removes the database dumps, deactivates the LVM snapshots)
42 Note that the client mode of SafeKeep should never be invoked manually,
44 this mode is meant to be used only by the server mode of SafeKeep. The
45 only exception to this is if run with the --cleanup option, which is
46 used to remove LVM snapshots and mounts created by Safekeep, after a
47 crash or some other failure, without a connection to the server.
48 Normally this cleanup would be performed through the server command
49 safekeep --server --cleanup.
50 The SSH key management mode is a helper mode for deploying or verifying
52 the setup of the SSH authentification keys.
53 In list mode, SafeKeep lists the details of existing archives. This is
55 basically an interface to the relevant options for rdiff-backup.
56 In server, keys management and list mode, you can restrict the
58 operation to a specific set of clients by listing the desired client
59 IDs as arguments. If no client ID is given, SafeKeep will operate over
60 all known clients.
61 Each mode accepts a few options as described below.
63
65 --server
66 Selects the server mode
67 --client
69 Selects the client mode. This should never be invoked manually, the
70 clients are started automatically by the server on the client
71 machines using SSH.
72 --keys
74 Selects the SSH key management mode
75 --list
77 Selects the list mode
78 Please note that you must always specify an operation mode. Earlier
79 versions used do default to --server mode, but that proved to work out
80 poorly in practice.
81
83 -c, --conf=FILE
84 Specifies the configuration file location. If not specified at all,
85 SafeKeep will default to /etc/safekeep/safekeep.conf, or optionally
86 in ~/.safekeep/safekeep.conf for non-root users, if it exists.
87 Simply using this default is the recommended usage.
88 -h, --help
90 Selects the help mode, in which safekeep prints out the online help
91 and exits.
92 -V, --version
94 Selects the version mode, in which safekeep prints out the version
95 number and exits.
96 -q, --quiet
98 Decreases the verbosity level. Can be specified more than once.
99 -v, --verbose
101 Increases the verbosity level. Can be specified more than once.
102 --noemail
104 Disables the sending of email, no matter what the settings within
105 the configuration file.
106
108 --force
109 Pass the --force option to rdiff-backup, allowing it to overwrite
110 the backup directory metadata. This option is potentially
111 dangerous, and should only be used if the backup directory becomes
112 corrupt, and rdiff-backup error logs tells you to use this option.
113 --cleanup
115 Remove LVM snapshots and mounts left by Safekeep after a crash or
116 other failure. This will run also run the standard cleanup
117 processes, such as the removal of an DB dumps, and forces a
118 consistency check of the rdiff-backup destination directory. This
119 is the prefered cleanup procedure and can be run with no danger of
120 corrupting the system if there is nothing to cleanup.
121 --tempdir TEMPDIR
123 Specifes a TEMPDIR for use with ‘rdiff-backup’. This overrides any
124 TEMPDIR specified in the ‘safekeep.conf’.
125
127 --cleanup
128 Remove LVM snapshots and mounts left after a crash or other failure
129 from the local system. Unlike the equivalent --server option, it
130 does not do any other of the standard cleanups. This option should
131 only be used when it is not possible to refer to the server, for
132 example, when the network connection to the server is no longer
133 available.
134
136 -i FILE
137 Forces ssh(1) to use FILE for the identity (private key) in RSA/DSA
138 authentication. If not specified, ssh(1) will use its default
139 identity files.
140 --status
142 Display the key status for the clients. It is implied if no other
143 option is specified. In effect this option prints the steps that
144 will be taken when the keys are deployed to the client.
145 --print
147 Display the authorization keys for the clients. This is useful in
148 case you want to manually copy it into the client’s
149 ~/.ssh/authorized_keys file. This option is seldom useful.
150 --deploy
152 Deploy the authorization keys on the clients.
153
155 --increments
156 Pass the --list-increments option to rdiff-backup, to list the
157 number and date of partial incremental backups for the given or all
158 clients. This is the default list option.
159 --parseable-output
161 Pass the --parsable-output option to rdiff-backup to generate
162 output in a format that is easily parsed by other programs. This
163 currently only works with the --increments.
164 --sizes
166 Pass the --list-increment-sizes option to rdiff-backup, to list the
167 total size of all increment and mirror files by time for the given
168 or all clients. Note, this may take some time.
169 --changed=TIME
171 Pass the --list-changed-since option for TIME to rdiff-backup, to
172 list the files changed since TIME for the given clients. TIME is
173 passed directly to rdiff-backup. Note, this may take some time and
174 generate considerable output. Also, unlike rdiff-backup the is no
175 option to select sub-directories.
176 --at-time=TIME
178 Pass the --list-at-time option for TIME to rdiff-backup, to list
179 the files in the archive that were present at the given time for
180 the given clients. Note, this may take some time and generate
181 considerable output. Also, unlike rdiff-backup the is no option to
182 select sub-directories.
183
185 Normally the configuration files are placed in the
186 /etc/safekeep/backup.d/ directory, or optionally in
187 ~/.safekeep/backup.d/ for non-root users, from where they will get
188 picked up automatically by SafeKeep. Each backup client is described by
189 a configuration file in XML format. The minimum configuration file is:
190 <backup>
193 <host name="my_workstation" />
194 </backup>
195 This will simply backup all relevant files (excluding temporary files,
197 caches, etc) from the client with the address my_workstation.
198 A more realistic example:
200 <backup>
203 <host name="my_workstation" />
204 <repo retention="10D" />
205 <setup>
206 <dump type="postgres" dbuser="postgres" file="/var/lib/pgsql/backups/all_dbs" />
207 <dump type="mysql" user="mysql" dbuser="dbbackup" db="adatabase" file="/var/backups/dumps/adatabase_dbs" />
208 <dump type="mysql" user="mysql" dbuser="dbbackup" db="mysql" file="/var/backups/dumps/mysql_dbs" cleanup="true" />
209 <snapshot device="/dev/mapper/VolGroup00-LogVol00" size="500M" />
210 </setup>
211 <data>
213 <exclude regexp=".*\.ogg"/>
214 <exclude regexp=".*\.mp3"/>
215 <include path="/etc"/>
217 <exclude glob="/home/*/tmp"/>
219 <include path="/home"/>
220 <include path="/root"/>
222 <include path="/srv"/>
224 <exclude path="/var/cache"/>
226 <exclude path="/var/lock"/>
227 <exclude path="/var/run"/>
228 <exclude path="/var/tmp"/>
229 <include path="/var/named/chroot/etc"/>
230 <include path="/var/named/chroot/var/named"/>
231 <exclude path="/var/named/chroot"/>
232 <include path="/var"/>
233 <exclude path="/"/>
235 </data>
236 </backup>
237 In this case, SafeKeep will dump all databases managed by PostgreSQL,
239 snapshot the disk via LVM, and proceed to backup /etc, /home, /root,
240 /srv, /var, while excluding some unneeded files and directories. Older
241 data will be retained for 10 days.
242 For full reference documentation of the configuration format, see
244 safekeep.backup(5).
245
247 Normally the client IDs are generated automatically from the
248 configuration filenames without the extension. E.g. if a configuration
249 file is named my_workstation.conf, the client ID becomes
250 my_workstation. For more information on this topic, see
251 safekeep.backup(5).
252
254 The safekeep(1) server needs to access the clients in order to conduct
255 the backup. To that end, it establishes two ssh(1) pipes: one for
256 control, and one for data. To simplify the deployment of the keys,
257 safekeep(1) has a key deploy mode.
258 When deploying keys using the built-in key management functionality,
260 safekeep(1) needs to be invoked as the user under which it will
261 function as a server. By default, that user is safekeep. For extra
262 security, you can not login into that account, so you have to invoke
263 safekeep(1) as root:
264 [root@yourbox ~] # safekeep --keys --deploy
267
269 Since safekeep(1) is built around rdiff-backup(1), it doesn’t have any
270 built-in restore capabilities. It simply relies on rdiff-backup to
271 perform this task.
272 To do so, you just need to know the directory where the data is
274 actually stored. In a typical installation, for a box configured via
275 the file /etc/safekeep/backup.d/mybox.backup, the data will be stored
276 under /var/lib/safekeep/mybox/. Please refer to safekeep.backup(5) for
277 more information on this matter.
278 Once you have determined where the data will be stored (we’ll continue
280 the example above), all you have to do is run rdiff-backup:
281 # rdiff-backup -r 1s /var/lib/safekeep/mybox my-restore-dir
284 You will be able to find more information on the restore procedure in
286 the rdiff-backup(1) man page.
287
289 It is important to note that the include/exclude directives that
290 control file selection are matched in the order they appear in the
291 configuration file, and the first one that matches dictates whether the
292 file will be included or excluded. As a result, you have to add the
293 more specific ones first, or the more generic specifications will
294 always win. For example:
295 ...
298 <include path="/home"/>
299 <exclude path="/home/joe"/>
300 ...
301 will NOT do what you expect, because the /home will match before
303 /home/joe, and thus all files under /home will be included. The correct
304 way is to flip the two around
305 ...
308 <exclude path="/home/joe"/>
309 <include path="/home"/>
310 ...
311 Please see safekeep.backup(5) for more information on file selection.
313
315 rdiff-backup(1), safekeep.conf(5), safekeep.backup(5)
316
318 Written by Dimi Paun <dimi@lattica.com[1]> and Stelian Pop
319 <stelian@lattica.com[2]>.
320
322 1. dimi@lattica.com
323 mailto:dimi@lattica.com
324 2. stelian@lattica.com
326 mailto:stelian@lattica.com
327safekeep 07/23/2021 SAFEKEEP(1)