|
|
@@ -5,7 +5,7 @@
|
|
|
# https://github.com/k0lter/autopostgresqlbackup
|
|
|
# Copyright (c) 2005 Aaron Axelsen <axelseaa@amadmax.com>
|
|
|
# 2005 Friedrich Lobenstock <fl@fl.priv.at>
|
|
|
-# 2013-2022 Emmanuel Bouthenot <kolter@openics.org>
|
|
|
+# 2013-2023 Emmanuel Bouthenot <kolter@openics.org>
|
|
|
#
|
|
|
# This program is free software; you can redistribute it and/or modify
|
|
|
# it under the terms of the GNU General Public License as published by
|
|
|
@@ -45,7 +45,7 @@ DBNAMES="all"
|
|
|
GLOBALS_OBJECTS="postgres_globals"
|
|
|
|
|
|
# Backup directory location e.g /backups
|
|
|
-BACKUPDIR="/backups"
|
|
|
+BACKUPDIR="/var/backups"
|
|
|
|
|
|
# Email Address to send mail to? (user@domain.com)
|
|
|
MAILADDR="user@domain.com"
|
|
|
@@ -80,7 +80,7 @@ BRWEEKLY=5
|
|
|
# Default is 12 months
|
|
|
BRMONTHLY=12
|
|
|
|
|
|
-# Choose Compression type. (gzip, bzip2, xz or zstd)
|
|
|
+# Choose Compression type. (gzip, pigz, bzip2, xz or zstd)
|
|
|
COMP=gzip
|
|
|
|
|
|
# Compression options
|
|
|
@@ -96,26 +96,21 @@ EXT="sql"
|
|
|
PERM=600
|
|
|
|
|
|
# Encryption settings
|
|
|
-# (inspired by http://blog.altudov.com/2010/09/27/using-openssl-for-asymmetric-encryption-of-backups/)
|
|
|
#
|
|
|
# It is recommended to backup into a staging directory, and then use the
|
|
|
# POSTBACKUP script to sync the encrypted files to the desired location.
|
|
|
#
|
|
|
-# Encryption uses private/public keys. You can generate the key pairs like the following:
|
|
|
-# openssl req -x509 -nodes -days 100000 -newkey rsa:2048 -keyout backup.key -out backup.crt -subj '/'
|
|
|
+# For now the only encryption method supported is using GnuPG
|
|
|
#
|
|
|
# Decryption:
|
|
|
-# openssl smime -decrypt -in backup.sql.gz.enc -binary -inform DEM -inkey backup.key -out backup.sql.gz
|
|
|
-
|
|
|
+# gpg --decrypt --output backup.sql.gz backup.sql.gz.enc
|
|
|
+#
|
|
|
# Enable encryption
|
|
|
ENCRYPTION=no
|
|
|
|
|
|
# Encryption public key (path to the key)
|
|
|
ENCRYPTION_PUBLIC_KEY=""
|
|
|
|
|
|
-# Encryption Cipher (see enc manpage)
|
|
|
-ENCRYPTION_CIPHER="aes256"
|
|
|
-
|
|
|
# Suffix for encyrpted files
|
|
|
ENCRYPTION_SUFFIX=".enc"
|
|
|
|
|
|
@@ -127,10 +122,6 @@ ENCRYPTION_SUFFIX=".enc"
|
|
|
# }}}
|
|
|
|
|
|
# {{{ OS Specific
|
|
|
-#=====================================================================
|
|
|
-# Debian specific options ===
|
|
|
-#=====================================================================
|
|
|
-
|
|
|
if [ -f /etc/default/autopostgresqlbackup ]; then
|
|
|
# shellcheck source=/dev/null
|
|
|
. /etc/default/autopostgresqlbackup
|
|
|
@@ -187,6 +178,7 @@ fi
|
|
|
|
|
|
# {{{ Defaults
|
|
|
PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/postgres/bin:/usr/local/pgsql/bin
|
|
|
+HOMEPAGE="https://github.com/k0lter/autopostgresqlbackup"
|
|
|
NAME="AutoPostgreSQLBackup" # Script name
|
|
|
VERSION="2.0" # Version Number
|
|
|
DATE="$(date '+%Y-%m-%d_%Hh%Mm')" # Datestamp e.g 2002-09-21
|
|
|
@@ -207,6 +199,9 @@ LOG_FILE="${LOG_DIR}/${NAME}_${DBHOST//\//_}-$(date '+%Y-%m-%d_%Hh%Mm').log"
|
|
|
# Debug mode
|
|
|
DEBUG="no"
|
|
|
|
|
|
+# Encryption prerequisites
|
|
|
+GPG_HOMEDIR=
|
|
|
+
|
|
|
# pg_dump options
|
|
|
if [ -n "${OPT}" ]; then
|
|
|
IFS=" " read -r -a PG_OPTIONS <<< "${OPT}"
|
|
|
@@ -305,6 +300,15 @@ log_warn() {
|
|
|
}
|
|
|
# }}}
|
|
|
|
|
|
+# {{{ gpg_setup()
|
|
|
+gpg_setup() {
|
|
|
+ GPG_HOMEDIR="$(mktemp --quiet --directory -t "${NAME}.XXXXXX")"
|
|
|
+ chmod 700 "${GPG_HOMEDIR}"
|
|
|
+ log_debug "With encryption enabled creating a temporary GnuPG home in ${GPG_HOMEDIR}"
|
|
|
+ gpg --quiet --homedir "${GPG_HOMEDIR}" --quick-gen-key --batch --passphrase-file /dev/null "root@$(hostname --fqdn)"
|
|
|
+}
|
|
|
+# }}}
|
|
|
+
|
|
|
# {{{ dblist()
|
|
|
dblist () {
|
|
|
local cmd_prog cmd_args raw_dblist dblist dbexcl databases
|
|
|
@@ -388,8 +392,8 @@ dbdump () {
|
|
|
|
|
|
# {{{ encryption()
|
|
|
encryption() {
|
|
|
- log_debug "Encrypting using cypher ${ENCRYPTION_CIPHER} and public key ${ENCRYPTION_PUBLIC_KEY}"
|
|
|
- openssl smime -encrypt -${ENCRYPTION_CIPHER} -binary -outform DEM "${ENCRYPTION_PUBLIC_KEY}" 2>&7
|
|
|
+ log_debug "Encrypting using public key ${ENCRYPTION_PUBLIC_KEY}"
|
|
|
+ gpg --homedir "${GPG_HOMEDIR}" --encrypt --passphrase-file /dev/null --recipient-file "${ENCRYPTION_PUBLIC_KEY}" 2>&7
|
|
|
}
|
|
|
# }}}
|
|
|
|
|
|
@@ -429,7 +433,7 @@ dump() {
|
|
|
comp_ext=".zstd"
|
|
|
;;
|
|
|
esac
|
|
|
- dump_file="${dump_file}.${comp_ext}"
|
|
|
+ dump_file="${dump_file}${comp_ext}"
|
|
|
fi
|
|
|
|
|
|
if [ "${ENCRYPTION}" = "yes" ]; then
|
|
|
@@ -545,6 +549,7 @@ fi
|
|
|
|
|
|
# {{{ main()
|
|
|
log_info "${NAME} version ${VERSION}"
|
|
|
+log_info "Homepage: ${HOMEPAGE}"
|
|
|
log_info "Backup of Database Server - ${HOST}"
|
|
|
|
|
|
if [ -n "${COMP}" ]; then
|
|
|
@@ -554,9 +559,28 @@ if [ -n "${COMP}" ]; then
|
|
|
fi
|
|
|
fi
|
|
|
|
|
|
-if [ "${ENCRYPTION}" = "yes" ] && ! command -v "openssl" >/dev/null ; then
|
|
|
- log_warn "Disabling encryption, 'openssl' command not found"
|
|
|
- ENCRYPTION="no"
|
|
|
+if [ "${ENCRYPTION}" = "yes" ]; then
|
|
|
+ if [ ! -s "${ENCRYPTION_PUBLIC_KEY}" ]; then
|
|
|
+ log_warn "Disabling encryption, '${ENCRYPTION_PUBLIC_KEY}' is empty or does not exists"
|
|
|
+ ENCRYPTION="no"
|
|
|
+ elif ! command -v "gpg" >/dev/null ; then
|
|
|
+ log_warn "Disabling encryption, 'gpg' command not found"
|
|
|
+ ENCRYPTION="no"
|
|
|
+ else
|
|
|
+ gpg_setup
|
|
|
+ if ! keyinfo="$(gpg --quiet --homedir "${GPG_HOMEDIR}" "${ENCRYPTION_PUBLIC_KEY}" 2>/dev/null)"; then
|
|
|
+ log_warn "Disabling encryption, key in '${ENCRYPTION_PUBLIC_KEY}' does not seems to be a valid public key"
|
|
|
+ ENCRYPTION="no"
|
|
|
+ if command -v "openssl" >/dev/null && openssl x509 -noout -in "${ENCRYPTION_PUBLIC_KEY}" >/dev/null 2>&1; then
|
|
|
+ log_warn "public key in '${ENCRYPTION_PUBLIC_KEY}' seems to be in PEM format"
|
|
|
+ log_warn "Encryption using openssl is no longer supported: see ${HOMEPAGE}#openssl-encryption"
|
|
|
+ fi
|
|
|
+ else
|
|
|
+ keyfp="$(echo "${keyinfo}" | sed -r -n 's/^\s*([a-z0-9]+)\s*$/\1/pi')"
|
|
|
+ keyuid="$(echo "${keyinfo}" | sed -r -n 's/^\s*uid\s+(\S.*)$/\1/pi' | head -n1)"
|
|
|
+ log_info "Encryption public key is: 0x${keyfp} (${keyuid})"
|
|
|
+ fi
|
|
|
+ fi
|
|
|
fi
|
|
|
|
|
|
log_info "Backup Start: $(date)"
|
|
|
@@ -630,17 +654,22 @@ if [ "${DEBUG}" = "no" ] && grep -q '^err|' "${LOG_FILE}" ; then
|
|
|
fi
|
|
|
done
|
|
|
printf "\nFor more information, try to run %s in debug mode, see \`%s -h\`\n" "${NAME}" "$(basename "$0")"
|
|
|
- ) | mail -s "${NAME} - log" "${MAILADDR}"
|
|
|
+ ) | mail -s "${NAME} issues on $(hostname --fqdn)" "${MAILADDR}"
|
|
|
fi
|
|
|
# }}}
|
|
|
|
|
|
-# {{{ Cleanup logs and exit()
|
|
|
+# {{{ Cleanup and exit()
|
|
|
if [ -s "${LOGERR}" ]; then
|
|
|
rc=1
|
|
|
else
|
|
|
rc=0
|
|
|
fi
|
|
|
|
|
|
+# Cleanup GnuPG home dir
|
|
|
+if [ -d "${GPG_HOMEDIR}" ]; then
|
|
|
+ rm -rf "${GPG_HOMEDIR}"
|
|
|
+fi
|
|
|
+
|
|
|
# Clean up log files
|
|
|
rm -f "${LOG_FILE}"
|
|
|
|
Emmanuel Bouthenot
Emmanuel Bouthenot
Daniel Scharon