system backup

This document describes my procedure to backup my Debian server to a remote FTP server where the tar archives are encrypted.

The whole backup is created in a temporary directory which is created first and removed after everything is done.

To get the ftp access working properly, the ~/.netrc must enable the autologin to that server.

I define static exclude patterns in a local file and also exclude all files which are part of any installed Debian package.

In case I modified any configuration file, I keep it in an RCS repository, so in case a file of a package exists in the repository, it is not excluded.

So this procedure works like this:

1. walk through all packages
2. walk through all files (and files only) of each package
3. if a RCS repositiory does not exists, add the file to the exclude list; RCS repositories are always in a subdirectory named ./RCS and have the same name as the file itself with an additional suffix ,v.

Separate tar files are created for /home, /usr, /var and /. All the archives use the same exclude list.

After the tar files are there, each of them gets encrypted with the same, symmetric key which is available cleartext. There is no need to encrypt the key itself here because if an attacker already has access to the server he has absolutely no need to play around with the backup files.

Moreover, I store SHA1 fingerprints of all files - the plain archives and the encrypted files - to make sure they have kept their integrity.

After the encryption is done, I log in to the FTP server and remove any backup files older than 3 months. This is a little clumsy on a FTP server but, of course, a necessary step.

As last step we upload the SHA1 checksum file and the *.tar.gz.gpg files to the backup server.

The script is here for download. A SHA1 fingerprint of this package can be found here. The files can be viewed here.