Xi Group Ltd

We always had a strong position about backups. Everyone must do backups!!! It is not optional, it is mandatory! It is a process that’s well understood, but somehow underestimated by many administrators and operators.

And you only have to obey the following rules:

• Backup all important data
• Backup on regular intervals
• Restore often to verify backup works

Yes, there are others, and you can start reading here, but stick to those above and you’ll sleep at least a bit easier.

To help you get started, here is a script we are using on our Linux boxes:

#!/bin/sh

# Directories to backup
B_DIRS="
	"

# MySQL Databases to backup
B_DBS="
	"

# Backup ID
B_ID=`date +%Y%m%d-%H%M`

# Backup Destination (local directory or ssh-user@host:/path)
B_DEST=""

# SQL Credentials
SQL_USER=""
SQL_PASS=""
SQL_HOST=""

# Paths of different system utilities
MYSQLDUMP="/usr/bin/mysqldump"
RSYNC="/usr/bin/rsync"
OPENSSL="/usr/bin/openssl"
TAR="/bin/tar"
BZIP2="/bin/bzip2"
LOGGER="/usr/bin/logger"

# Temporary folder
TMP_DIR="/tmp"

###########################################################################
# !!! DO NOT EDIT AFTER THIS POINT UNLESS YOU KNOW WHAT YOU ARE DOING !!! #
###########################################################################

# Saving current working directory
CWD=`pwd`

# Check if all the utilities are already preset and available
if [ ! -x "$LOGGER" ]; then
	echo "backup.sh - Missing logger utility"
	exit 1
fi

if [ ! -x "$MYSQLDUMP" ]; then
	$LOGGER "backup.sh - Missing mysqldump"
	exit 1
fi

if [ ! -x "$RSYNC" ]; then
	$LOGGER "backup.sh - Missing rsync"
	exit 1
fi

if [ ! -x "$BZIP2" ]; then
	$LOGGER "backup.sh - Missing bzip2"
	exit 1
fi

if [ ! -x "$TAR" ]; then
	$LOGGER "backup.sh - Missing tar"
	exit 1
fi

if [ ! -x "$OPENSSL" ]; then
	$LOGGER "backup.sh - Missing openssl"
	exit 1
fi

# Check if all the directories are present and writable
if [ ! -d "$TMP_DIR" -o ! -w "$TMP_DIR" ]; then
	$LOGGER "backup.sh - Temporary directory does not exist or is not writable"
	exit 1
fi

for B_DIR in $B_DIRS; do
	if [ ! -d "$B_DIR" -o ! -r "$B_DIR" ]; then
		$LOGGER "backup.sh - $B_DIR does not exist or is not readable"
		exit 1
	fi
done

# Create temporary directory
mkdir $TMP_DIR/backup-$B_ID

if [ ! -d "$TMP_DIR/backup-$B_ID" ]; then
	$LOGGER "backup.sh - Can not create temporary directory"
	exit 1
fi

# Copy every directory to the backup localtion
for B_DIR in $B_DIRS; do
	cp -R $B_DIR $TMP_DIR/backup-$B_ID
done

# Dump all databases
for DB in $B_DBS; do
	$MYSQLDUMP --single-transaction -h $SQL_HOST -u $SQL_USER -p"$SQL_PASS" $DB > $TMP_DIR/backup-$B_ID/$DB-`date +%Y%m%d`.sql
done

# Package everything
$TAR -jcf $TMP_DIR/backup-$B_ID.tar.bz2 $TMP_DIR/backup-$B_ID 

# Encrypt backup (NOTE: If you enable this modify the next two steps appropriately)
# $OSSL -in $TMP_DIR/backup-$B_ID.tar.bz2 enc -aes-256-cbc -salt -pass pass:'YOUR_PASS' -out $TMP_DIR/backup-$B_ID.tar.bz2.enc

# Distribute towards destination
$RSYNC $TMP_DIR/backup-$B_ID.tar.bz2 $B_DEST

# Clean Up
rm -rf $TMP_DIR/backup-$B_ID $TMP_DIR/backup-$B_ID.tar.bz2

# Log statistic information
$LOGGER "backup.sh - Backup finished at `date +%Y%m%d-%H:%M`"

You need to edit several parts of it, but it works OK for most of our needs and costs nothing.

Edit:

• B_DIRS and B_DBS to identify what;
• B_DEST to identify where the backup should be stored;
• SQL_* to supply MySQL credentials.

Save as backup.sh and add it to your crontab.

Enjoy!

In a modern network environment, protocol designers are rarely presented with the case of full network control. Usually, at least part of the communication will pass through public networks. In many cases, protocol designers should even account for hostile actions, both internal and external. To provide stable and reliable operations in hostile (or just public) environment, security must be integral part of the protocol. Here we are going to discuss several approaches towards network protocol security during the design/implementation or upgrade phase.

There are several ways to tackle the security issue. The easy way is to rely on external security mechanisms. Those can be provided either by technologies like IPSEC, some form of secure, application tunnel, like SSL/TLS, or a VPN solution, like OpenVPN. There are distinct advantages in this approach: protocol simplicity, easy to focus on the main protocol goal and not get entangled in all the security extensions, wide variety of authentication/authorization/encryption mechanisms provided by the external technology. There are also disadvantages like added administrative cost for proper security setup and support, dependency on a technology that may not be present on all platforms (embedded device may lack IPSEC support, or enough storage space for OpenVPN client), third party limitations, royalties.

If external security mechanims are not an option, there are two possible approaches. First one is using some encryption protocol directly. AES, Blowfish and Serpent are, de facto, the standard. They are easy to deal with. Implementations are available in the following libraries:

• OpenSSL
• LibTomCrypt
• CTaoCrypt
• PolarSSL
• MatrixSSL

Although, symetric ciphers are easy to work with, they have one distinct disadvantage: the shared key should be somehow distributed over all the communicating parties. In case those are many and constantly changing this can be serious issue. Secure shared key distribution is the corner stone of successful symetric cipher use. Symetric ciphers are also ideal for secure communication between peers with similar or equal access rights. For more complicated needs, however, those are not enough.

The most complex and feature-rich approach is to use SSL/TLS. It provides secure communication and peer authentication. Access controls can be built on top of TLS. In order to function, TLS requires digital certificates. For most of the features, full blown certificate management infrastructure should be established with added administrative and security cost. Following implementations are available:

• OpenSSL
• GnuTLS
• NSS
• yaSSL
• PolarSSL
• MatrixSSL

Whenever possible, TLS should the choice for secure protocol implementation. It is always better to use proven network technology, then try to achieve security through obscurity.