Lead Image © Dmitry Pichugin, Fotolia.com

Backups using rdiff-backup and rsnapshot

Brothers

Article from ADMIN 31/2016

By Georg Schönberger

The easier you can back up and restore data, the better. Mature Linux tools show that performing regular, automated backups doesn't have to be a pain.

The first step in ensuring comprehensive backups is to consider where the backups should be stored; therefore, a separate backup server is often used that connects to other computers and initiates the backups. Alarm bells will be ringing for security-conscious administrators at this point – the backup server can connect to all the other machines! Safeguarding the backup server and its connection scheme is therefore extremely important, not least because the productive data for all systems are on the backup server.

Automated backups in Linux usually require a user who connects to the system to be backed up using public key authentication. Two security aspects are critical: First, the user needs root rights for the target system to be able to back up all the data, and, second, the private SSH keys for automation are not password protected. In this article, I provide a detailed set of instructions for how to counteract these weak points using the following simple restrictions:

Create a separate key pair for the backup user and limit the permitted commands to the systems to be backed up using authorized_keys.
Create a sudo configuration for the backup user that only allows the backup program (rdiff-backup or rsnapshot) to dispense with a password entry.

rdiff-backup vs. rsnapshot

The two command-line tools rdiff-backup and rsnapshot are well-known backup programs in Linux. After initial configuration, their simplicity and reliability are very impressive. Table 1 shows the most important functions for both tools and provides some initial information about backup concepts.

Table 1

rdiff-backup and rsnapshot Differences

...

Use Express-Checkout link below to read the full article (PDF).