The Funtoo Linux project has transitioned to "Hobby Mode" and this wiki is now read-only.
Cloud Backup
This howto will describe a method for automatically backing up your funtoo install to the internet, in this case dropbox, but any online storage will do. Gentoo describes a method of creating a stage 4 archive. The problem with a stage 4 is that it is large and it archives a lot of unnecessary files. Such as applications that can be reinstalled from an emerge world. Instead, this method will aim for more of a "stage 3.5."
This method does not attempt to backup everything. The intention is only to backup the system. Optionally you can also archive and copy your /home folder if you have enough online storage.
Use Case
A backup machine currently provides network drives on a home LAN to allow clients on the LAN to backup to, using apps such as Time Machine (Mac) and Genie Timeline (Windows). As this machine is the backup machine it doesn't have anywhere to backup to itself. In this situation a backup solution is provided by backing up to somewhere online - dropbox. If a restore from the backup is required, the client machine's backups would be trashed, and the backup machine restored.
Automatic Backup Archives With Etckeeper
Etckeeper is a tool that is used to save versions of /etc, including meta-data in a version control repository such as git. As etckeeper is not in the funtoo portage tree, layman is used to provide an overlay.
Install etckeeper via layman
Before you install layman it is worth mentioning that you probably want USE="git subversion" in /etc/portage/make.conf. After adjusting use flags, to install layman you run:
root # emerge layman
In order to backup the layman configuration, but not the portage overlay trees, make the following modifications to the default install. Tell Portage about layman-fetched repositories by adding the following line to /etc/portage/make.conf:
source /etc/layman/make.conf
Modify the following lines in /etc/layman/layman.cfg:
storage : /var/lib/layman installed : /etc/layman/installed.xml make_conf : /etc/layman/make.conf
Add the bgo-overlay. As described on their web page, bgo.zugaina.org.
root # layman -o http://gpo.zugaina.org/lst/gpo-repositories.xml -L root # layman -a bgo-overlay -o http://gpo.zugaina.org/lst/gpo-repositories.xml
More information about layman can be found here: http://www.gentoo.org/proj/en/overlays/userguide.xml
Then unmask and install etckeeper.
root # emerge etckeeper --autounmask-write root # emerge etckeeper
To update layman overlays do:
root # layman -S
If you see the following error -- apply this fix:
root # emerge etckeeper Calculating dependencies... done! >>> Verifying ebuild manifests !!! A file is not listed in the Manifest: '/var/lib/layman/bgo-overlay/sys-apps/etckeeper/files/etckeeper-gentoo-0.58.patch' root # cd /var/lib/layman/bgo-overlay/sys-apps/etckeeper root # ebuild etckeeper-0.58-r2.ebuild manifest root # emerge etckeeper
Configure etckeeper
Move any config files that do not live in /etc. i.e. Check /root for any files to be archive, such as iptables scripts and move them to /etc.
because funtoo uses Boot-Update, this means /boot/grub/grub.cfg does not need to be archived.
To ensure your portage world file is archived, make the following link:
root # ln /var/lib/portage/world /etc/world
Initialise the git repository.
root # etckeeper init Initialized empty Git repository in /etc/.git/ root # etckeeper commit "Initial commit."
If you don't already have cron installed, emerge it now.
root # emerge vixie-cron
And write the cron job to save an hourly version of /etc.
git will only create a new version (commit) if there are changes from the previous one.
Edit the file /etc/cron.hourly/etckeeper:
#! /bin/bash etckeeper commit "Hourly auto-commit"
Encrypt and copy backups online
Copy To Dropbox
root # emerge dropbox
Add a dropbox user:
root # useradd dropbox
Write the dropbox init files in /etc/conf.d/dropbox:
DROPBOX_USERS="dropbox"
#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License, v2 or later
# $Header: /var/cvsroot/gentoo-x86/sys-fs/dropbox/files/dropbox.init-1.0,v 1.4 2007/04/04 13:35:25 cardoe Exp $
NICENESS=5
depend() {
need localmount net
after bootmisc
}
start() {
ebegin "Starting dropbox..."
for dbuser in $DROPBOX_USERS; do
start-stop-daemon -S -b -m --pidfile /var/run/dropbox-$dbuser.pid -N $NICENESS -u $dbuser -v -e HOME="/home/$dbuser" -x /opt/dropbox/dropboxd
done
eend $?
}
stop() {
ebegin "Stopping dropbox..."
for dbuser in $DROPBOX_USERS; do
start-stop-daemon --stop --pidfile /var/run/dropbox-$dbuser.pid
done
eend $?
}
status() {
for dbuser in $DROPBOX_USERS; do
if [ -e /var/run/dropbox-$dbuser.pid ] ; then
echo "dropboxd for USER $dbuser: running."
else
echo "dropboxd for USER $dbuser: not running."
fi
done
eend $?
}
Start dropbox now and at boot time:
root # chmod 0755 /etc/init.d/dropbox root # /etc/init.d/dropbox start root # rc-update add dropbox default
After starting the dropbox daemon, it will provide a http link. You will need to visit this site just once to associate your computer with your dropbox account.
Write the cron job to make the backup archive and move it online. Edit the file /etc/cron.daily/backup:
#! /bin/bash cd /etc git bundle create /tmp/backup.bundle --all cd /tmp mv -v -f backup.bundle /home/dropbox/Dropbox/Private/
Make the script executable:
root # chmod +x /etc/cron.daily/backup
Encrypt Backups
It is a good idea to encrypt your backup before moving it online. This can be done with gpg, using a symmetric (password only) or public/private key encryption. Additionally you can chose to sign the backup to check its integrity before restoring.
root # emerge gpg
Symmetric Encryption
There is no preparation required to use a symmetric key as all that is required is simply a passphrase. Just modify the cron job. Edit /etc/cron.daily/backup:
#! /bin/bash cd /etc git bundle create /tmp/backup.bundle --all cd /tmp echo 'encryption_password' | gpg -o backup.gpg --batch --homedir /root/.gnupg -vvv --passphrase-fd 0 --yes -c backup.bundle mv -v -f router.gpg /home/dropbox/Dropbox/Private/
Remember to change "encryption_password"
If you forget this password the backup will be unusable. Lose the password and you lose the backup.
As there is now sensitive information in this file, you might want to remove read permission:
root # chmod og-r /etc/cron.daily/backup
Private/Public key Encryption
Make a private/public encryption/decryptions key pair. The public key will be used to encrypt and the private key to decrypt.
root # gpg --gen-key
The public key is used to create the encrypted backup and needs to live on the computer being backed up. A copy of the private key needs to be made and stored securely in another place. If this machine becomes unbootable, and this is the only place the private key lives, the backup dies with it. The private key should not be kept:
- In the same place as the back up
- On the machine being backed up
The private key is the only key that will decrypt the backup. Lose this key and/or it's password and you lose the backup.
List the private keys:
root # gpg -K /root/.gnupg/secring.gpg ------------------------ sec 2048R/0EF13559 2012-01-21 uid my_key <noone@example.com> ssb 2048R/67417FEB 2012-01-21
The private key can be exported using either the key name or key number. In this case "my_key" or "0EF13559". To cut and paste the key. Ie, if logging in remotely.
root # gpg -a --export-secret-key 0EF13559
To create a key file:
root # gpg -o private_decryption.gpgkey --export-secret-key 0EF13559
Now store this key somewhere secure. The backup is only as secure as the private key.
Modify the cron job at /etc/cron.daily/backup:
#! /bin/bash cd /etc git bundle create /tmp/backup.bundle --all cd /tmp gpg -o backup.gpg -r 'my-key' --batch --homedir /root/.gnupg -vvv --passphrase-fd 0 --yes -e backup.bundle mv -v -f backup.gpg /home/dropbox/Dropbox/Private/
Replace "my-key" with the appropriate name from the key list. Also note the change from -c for symmetric encryption to -e for private/public key encryption
Sign Backups
Create a 2nd private/public (signing) key pair. The private key is used to sign and the public key is used to check the authenticity/integrity.
root # gpg --gen-key
The password for this key will be required in the script below.
In this case the private key is required to sign the backup and the public key is used to check the integrity of the backup. Follow a similar process as above to copy the public key to to another computer/storage media.
List the private keys:
root # gpg -k
-K lists private keys while -k lists public keys.
Then export this public key via cut and paste:
root # gpg -a --export <key name or number>
Or to create a key file:
root # gpg -o public_signing.gpgkey --export <key name or number>
Now store this key somewhere secure.
Modify the backup cron job at /etc/cron.daily/backup:
#! /bin/bash cd /etc git bundle create /tmp/backup.bundle --all cd /tmp echo 'signing_key_password' | gpg -s -o backup.gpg -r 'my-encryption-key' --batch --homedir /root/.gnupg -vvv --passphrase-fd 0 --yes -e backup.bundle mv -v -f backup.gpg /home/dropbox/Dropbox/Private/
the script will require the password for your private (signing) key to sign the backup. Replace "password" with the password for your signing private key.
And as there is sensitive information in this file don't forget to remove read permission.
root # chmod og-r /etc/cron.daily/backup
To Restore From A Backup
This restore will assume your are starting with a new blank disk. Start by performing a stage 3 install, upto and including section 5 "Chroot into your new system." http://www.funtoo.org/wiki/Funtoo_Linux_Installation
Then the restore process is:
- Download backup from dropbox
- Decrypt
- Clone
- Link world file
- Emerge world
- Compile the kernel
- Restore grub bootloader
- Reboot
Download backup from dropbox
Log into your dropbox account and find your backup file. Move it to a public area if it isn't already in one. Then right click on it and click "copy public link." Now on the computer to be restored, delete the contents of the /etc folder and download the backup file.
(Need to check if this needs done before chrooting into the new install).
root # cd /etc root # rm -rf * root # cd /tmp root # wget http://dl.dropbox.com/link-to-backup-file/backup.gpg
if you have to copy the link from another computer and therefore can not cut and paste it, there is a "shorten link" option.
Decrypt
If you used a public/private key to encrypt, and optionally signed the backup, import the decryption and signing keys.
Note:
- The decryption key is the private key of the encryption key pair - private_decryption.gpgkey
- The signing key is the public key of the signing key pair - public_signing.gpgkey
To import the keys by cut and paste:
root # gpg --import <<EOF
The last line after pasting the key should be "EOF"
Repeat for both keys.
To import the keys by file:
root # gpg --import private_decryption.gpgkey root # gpg --import public_signing.gpgkey
Decrypt the backup:
root # gpg -d backup.gpg > backup.bundle
If the backup was signed and you have correctly imported the signing public key you should see a message similar to:
gpg: Good signature from "my_signing_key <noone@example.com>"
Clone
root # git clone /tmp/backup.bundle /etc/
Link world file
root # ln /etc/world /var/lib/portage/world
Emerge world
root # emerge --sync root # layman -S root # emerge -uDaNv world
Compile the kernel (genkernel)
If you have genkernel set to save config files (the default):
root # cp /etc/kernels/kernel-config-x86_64-<latest version>-gentoo /usr/src/linux/.config
Otherwise use the currently loaded kernel's config:
root # zcat /proc/config.gz > /usr/src/linux/.config
Then compile the kernel:
root # genkernel --oldconfig --no-mrproper all
Restore grub bootloader
root # grub-install --no-floppy /dev/sda root # boot-update
Adjust the device as required if installing to another location.
Reboot
root # reboot