Zum Inhalt springen

Duply: Unterschied zwischen den Versionen

Aus Foxwiki
Versionsgeschichte interaktiv durchsuchen
← Zum vorherigen Versionsunterschied
Visuell
Robertquies (Diskussion | Beiträge)
4.396 Bearbeitungen
K Textersetzung - „line>“ durch „line copy>“
 
(320 dazwischenliegende Versionen von 2 Benutzern werden nicht angezeigt)
Zeile 1: Zeile 1:
Ein einfaches Python-Script zur Erstellung von inkrementellen, symmetrisch verschlüsselten Backups auf Dateiebene.
'''duply''' - [[Inkrementell]]e [[verschlüsselt]]e [[Backup]]s


=duply=
== Beschreibung ==
* Ist ein Frontend von [https://de.wikipedia.org/wiki/Duplicity_(Software) duplicity].
; Frontend für [[duplicity]]
* Erstellte Backups können sowohl lokal am gesicherten Rechner, als auch entfernt (remote) auf einem anderen System gespeichert werden.
Shell-Frontend für [[duplicity]]
* Unterstützt <tt>ftp, ssh, s3, rsync, cifs, webdav, http</tt>.
* Verwendung vereinfachen
* Einstellungen in Profilen verwalten
* Stapelverarbeitung
** Es unterstützt die Ausführung von mehreren Befehlen als Stapelverarbeitung
** Damit sind einzeilige cron-Einträge möglich und der Benutzer kann Skripte verwenden, die vor oder nach dem Backup ausgeführt werden
* Alle duplicity-Backends werden unterstützt


=Installation=
; Vereinfacht die Ausführung von Duplicity
Frontend für [[duplicity]]
# apt install duply
* Backups können lokal oder einem anderen System gespeichert werden
* Cron oder Kommandozeile
* Speichert Einstellungen in Profilen
* Batch-Operationen
*: ermöglicht, beispielsweise backup_verify+purge
* Ausführung von Pre-/Post-Skripten
* verschiedene Aktionen möglich, abhängig vom vorherigen oder nächsten Befehl oder dessen Rückgabewert
* Vorbedingungsprüfung für fehlerfreie Duplizitätsoperationen


= Konfiguration =
Für jeden Sicherungsauftrag wird ein Konfigurationsprofil erstellt


==Neues duply-Profil erstellen==
; Profilordner
<syntaxhighlight lang="bash" highlight="1" line copy>
~/.duply/<profile>
</syntaxhighlight>


# duply <backupname> create
; Hinweis
: Wenn der Ordner '/etc/duply' existiert, werden die Profile für den Superuser Benutzer root dort gesucht und erstellt werden


Ein duply-Profil wird im Home-Verzeichnis des Benutzers unter '''~/.duply/''' automatisch angelegt und besteht aus den folgenden Dateien:
; Protokolle
* gpg-key.asc (Optional, nur wenn ein gpg-key exportiert wurde.)
{| class="wikitable options big"
* conf
! Protokoll !! Beschreibung
* pre und post
|-
* exclude
| [[ftp]] ||
|-
| [[ssh]] ||
|-
| [[s3]] ||
|-
| [[rsync]] ||
|-
| [[cifs]] ||
|-
| [[webdav]] ||
|-
| [[http]] ||
|}


==GPG-Key erstellen==
== Installation ==
Während der Erstellung des Keys ist es ratsam andere Arbeiten auf dem Host durchzuführen, um die Entropie am System zu erhöhen, z.B. durch schnelles Bewegen der Maus und/oder das Eintippen auf der Tastatur.
<syntaxhighlight lang="bash" highlight="1" line copy>
sudo apt install duply
Dies beschleunigt das Erstellen des Keys, weil dem Host schneller Zufallswerte (Random) zur Verfügung stehen, die für das Erstellen des Keys benötigt werden.
</syntaxhighlight>


  gpg --gen-key
=== Dateien ===
; /usr/bin/
  duply


gpg (GnuPG) 1.4.11; Copyright (C) 2010 Free Software Foundation, Inc.
; /usr/share
  This is free software: you are free to change and redistribute it.
  /doc/duply/
There is NO WARRANTY, to the extent permitted by law.
  README
  README.Debian
Please select what kind of key you want:
  TODO
    (1) RSA and RSA (default)
  changelog.Debian.gz
    (2) DSA and Elgamal
  changelog.gz
    (3) DSA (sign only)
  copyright
    (4) RSA (sign only)
  systemd-unit.examples
Your selection? '''1'''
  HOWTO.txt
RSA keys may be between 1024 and 4096 bits long.
  systemd-unit.examples/system/
What keysize do you want? (2048) '''4096'''
    duply-backup@.service
Requested keysize is 4096 bits
    duply-backup@.timer
Please specify how long the key should be valid.
    duply-cleanup@.service
          0 = key does not expire
    duply-cleanup@.timer
      <n>  <nowiki>= key expires in n days</nowiki>
    duply-verify@.service
      <n>w = key expires in n weeks
    duply-verify@.timer
      <n>m = key expires in n months
    notify-failed-backup@.service
      <n>y = key expires in n years
  systemd-unit.examples/user/
Key is valid for? '''(0)'''
    duply-backup@.service
Key does not expire at all
    duply-backup@.timer
Is this correct? (y/N) '''y'''
    duply-cleanup@.service
    duply-cleanup@.timer
You need a user ID to identify your key; the software constructs the user ID
    duply-verify@.service
from the Real Name, Comment and Email Address in this form:
    duply-verify@.timer
    '''"Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"'''
    notify-failed-backup@.service
   man/man1/
Real name: '''Example User'''
  duply.1.gz
Email address: '''email@example.com'''
Comment: '''Example Comment'''
You selected this USER-ID: '''"Example User <email@example.com>"'''
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? '''O'''
You need a Passphrase to protect your secret key.
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
Not enough random bytes available. Please do some other work to give
the OS a chance to collect more entropy! (Need 253 more bytes)
'''..........+++++'''
gpg: key 9627014B marked as ultimately trusted
public and secret key created and signed.
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:  2  signed:  0  trust: 0-, 0q, 0n, 0m, 0f, 2u
pub  4096R/'''9627014B''' 2013-06-07
      Key fingerprint = 705D B57E 8526 FB24 360E  E54D 13A1 AC6B 9627 014B
uid                  Example User <email@example.com>
sub   4096R/DB7D5661 2013-06-07


==conf-Datei==
== Aufruf ==
 
=== Argumente ===
===Aufrufen der conf-Datei===
=== Optionen ===
 
{| class="wikitable options"
Hier unter /root/.duply/backup/conf.
|-
 
! Option !! Beschreibung
# vi /root/.duply/backup/conf
|-
 
| --force || passed to duplicity (see commands purge, purgeFull, purgeIncr, cleanup)
# gpg encryption settings, simple settings:
|-
#  GPG_KEY='disabled' - disables encryption alltogether
| --preview || do nothing but print out generated duplicity command lines
#  GPG_KEY='<key1>[,<key2>]'; GPG_PW='pass' - encrypt with keys,
|-
#  sign if secret key of key1 is available use GPG_PW for sign & decrypt
| --disable-encryption || disable encryption, overrides profile settings
#  Note: you can specify keys via all methods described in gpg manpage,
|}
#        section "How to specify a user ID", escape commas (,) via backslash (\)
#        e.g. 'Mueller, Horst', 'Bernd' -> 'Mueller\, Horst, Bernd'
#        as they are used to separate the entries
#  GPG_PW='passphrase' - symmetric encryption using passphrase only
GPG_KEY='_KEY_ID_'
GPG_PW='_GPG_PASSWORD_'
# gpg encryption settings in detail (extended settings)
#  the above settings translate to the following more specific settings
#  GPG_KEYS_ENC='<keyid1>[,<keyid2>,...]' - list of pubkeys to encrypt to
#  GPG_KEY_SIGN='<keyid1>|disabled' - a secret key for signing
#  GPG_PW='<passphrase>' - needed for signing, decryption and symmetric
#  encryption. If you want to deliver different passphrases for e.g.
#  several keys or symmetric encryption plus key signing you can use
#  gpg-agent. Simply make sure that GPG_AGENT_INFO is set in environment.
#  also see "A NOTE ON SYMMETRIC ENCRYPTION AND SIGNING" in duplicity manpage
# notes on en/decryption
#  private key and passphrase will only be needed for decryption or signing.
#  decryption happens on restore and incrementals (compare archdir contents).
#  for security reasons it makes sense to separate the signing key from the
#  encryption keys. <nowiki>https://answers.launchpad.net/duplicity/+question/107216</nowiki>
#GPG_KEYS_ENC='<pubkey1>,<pubkey2>,...'
#GPG_KEY_SIGN='<prvkey>'
# set if signing key passphrase differs from encryption (key) passphrase
# NOTE: available since duplicity 0.6.14, translates to SIGN_PASSPHRASE
#GPG_PW_SIGN='<signpass>'
 
# uncomment and set a file path or name force duply to use this gpg executable
# available in duplicity 0.7.04 and above (currently unreleased 06/2015)
#GPG='/usr/local/gpg-2.1/bin/gpg'
 
# gpg options passed from duplicity to gpg process (default='')
# e.g. "--trust-model pgp|classic|direct|always"
#  or "--compress-algo=bzip2 --bzip2-compress-level=9"
#  or "--personal-cipher-preferences AES256,AES192,AES..."
#  or "--homedir ~/.duply" - keep keyring and gpg settings duply specific
#  or "--pinentry-mode loopback" - needed for GPG 2.1+ _and_
#      also enable allow-loopback-pinentry in your .gnupg/gpg-agent.conf
#GPG_OPTS=''
 
# disable preliminary tests with the following setting
#GPG_TEST='disabled'
# backend, credentials & location of the backup target (URL-Format)
# generic syntax is
#  scheme://[user[:password]@]host[:port]/[/]path
# eg.
#  <nowiki>sftp://bob:secret@backupserver.com//home/bob/dupbkp</nowiki>
# for details and available backends see duplicity manpage, section URL Format
#  <nowiki>http://duplicity.nongnu.org/duplicity.1.html#sect7</nowiki>
# BE AWARE:
#  some backends (cloudfiles, S3 etc.) need additional env vars to be set to
#  work properly, read after the TARGET definition for more details.
# ATTENTION:
#  characters other than A-Za-z0-9.-_.~ in the URL have to be
#  replaced by their url encoded pendants, see
#    <nowiki>http://en.wikipedia.org/wiki/Url_encoding</nowiki>
#  if you define the credentials as TARGET_USER, TARGET_PASS below duply
#  will try to url_encode them for you if the need arises.
TARGET='scheme://user[:password]@host[:port]/[/]path'
# optionally the username/password can be defined as extra variables
# setting them here _and_ in TARGET results in an error
# ATTENTION:
#  there are backends that do not support the user/pass auth scheme.
#  prominent examples are S3, Azure, Cloudfiles. when in doubt consult the
#  duplicity manpage. usually there is a NOTE section explaining if and which
#  env vars should be set.
#TARGET_USER='_backend_username_'
#TARGET_PASS='_backend_password_'
# eg. for cloud files backend it might look like this (uncomment for use!)
#export CLOUDFILES_USERNAME='someuser'
#export CLOUDFILES_APIKEY='somekey'
#export CLOUDFILES_AUTHURL ='someurl'
# the following is an incomplete list (<backend>: comma separated env vars list)
# Azure: AZURE_ACCOUNT_NAME, AZURE_ACCOUNT_KEY
# Cloudfiles: CLOUDFILES_USERNAME, CLOUDFILES_APIKEY, CLOUDFILES_AUTHURL
# Google Cloud Storage: GS_ACCESS_KEY_ID, GS_SECRET_ACCESS_KEY
# Pydrive: GOOGLE_DRIVE_ACCOUNT_KEY, GOOGLE_DRIVE_SETTINGS
# S3: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
# Swift: SWIFT_USERNAME, SWIFT_PASSWORD, SWIFT_AUTHURL,
#        SWIFT_TENANTNAME OR SWIFT_PREAUTHURL, SWIFT_PREAUTHTOKEN
# base directory to backup
SOURCE='/path/of/source'
# a command that runs duplicity e.g.
#  shape bandwidth use via trickle
#  "trickle -s -u 640 -d 5120" # 5Mb up, 40Mb down"
#DUPL_PRECMD=""
# override the used python interpreter, defaults to
#  - parsed result of duplicity's shebang or 'python2'
#  e.g. "python2" or "/usr/bin/python2.7"
#PYTHON="python"
# exclude folders containing exclusion file (since duplicity 0.5.14)
# Uncomment the following two lines to enable this setting.
#FILENAME='.duplicity-ignore'
#DUPL_PARAMS="$DUPL_PARAMS --exclude-if-present '$FILENAME'"
# Time frame for old backups to keep, Used for the "purge" command. 
# see duplicity man page, chapter TIME_FORMATS)
#MAX_AGE=1M
# Number of full backups to keep. Used for the "purgeFull" command.
# See duplicity man page, action "remove-all-but-n-full".
#MAX_FULL_BACKUPS=1
# Number of full backups for which incrementals will be kept for.
# Used for the "purgeIncr" command.
# See duplicity man page, action "remove-all-inc-of-but-n-full".
#MAX_FULLS_WITH_INCRS=1
# activates duplicity --full-if-older-than option (since duplicity v0.4.4.RC3)
# forces a full backup if last full backup reaches a specified age, for the
# format of MAX_FULLBKP_AGE see duplicity man page, chapter TIME_FORMATS
# Uncomment the following two lines to enable this setting.
#MAX_FULLBKP_AGE=1M
#DUPL_PARAMS="$DUPL_PARAMS --full-if-older-than $MAX_FULLBKP_AGE "
# sets duplicity --volsize option (available since v0.4.3.RC7)
# set the size of backup chunks to VOLSIZE MB instead of the default 25MB.
# VOLSIZE must be number of MB's to set the volume size to.
# Uncomment the following two lines to enable this setting.
#VOLSIZE=50
#DUPL_PARAMS="$DUPL_PARAMS --volsize $VOLSIZE "
# verbosity of output (error 0, warning 1-2, notice 3-4, info 5-8, debug 9)
# default is 4, if not set
#VERBOSITY=5
# temporary file space. at least the size of the biggest file in backup
# for a successful restoration process. (default is '/tmp', if not set)
#TEMP_DIR=/tmp
# Modifies archive-dir option (since 0.6.0) Defines a folder that holds
# unencrypted meta data of the backup, enabling new incrementals without the
# need to decrypt backend metadata first. If empty or deleted somehow, the
# private key and it's password are needed.
# NOTE: This is confidential data. Put it somewhere safe. It can grow quite
#      big over time so you might want to put it not in the home dir.
# default '~/.cache/duplicity/duply_<profile>/'
# if set  '${ARCH_DIR}/<profile>'
#ARCH_DIR=/some/space/safe/.duply-cache
# DEPRECATED setting
# sets duplicity --time-separator option (since v0.4.4.RC2) to allow users
# to change the time separator from ':' to another character that will work
# on their system.  HINT: For Windows SMB shares, use --time-separator='_'.
# NOTE: '-' is not valid as it conflicts with date separator.
# ATTENTION: only use this with duplicity < 0.5.10, since then default file
#            naming is compatible and this option is pending depreciation
#DUPL_PARAMS="$DUPL_PARAMS --time-separator _ "
# DEPRECATED setting
# activates duplicity --short-filenames option, when uploading to a file
# system that can't have filenames longer than 30 characters (e.g. Mac OS 8)
# or have problems with ':' as part of the filename (e.g. Microsoft Windows)
# ATTENTION: only use this with duplicity < 0.5.10, later versions default file
#            naming is compatible and this option is pending depreciation
#DUPL_PARAMS="$DUPL_PARAMS --short-filenames "
# more duplicity command line options can be added in the following way
# don't forget to leave a separating space char at the end
#DUPL_PARAMS="$DUPL_PARAMS --put_your_options_here "
 
===Symmetrische Verschlüsselung einrichten===
 
Key-ID und das Passwort des GPG-Keys müssen dafür hinterlegt werden.
 
Hier lautet die Key-ID '''9627014B''' (siehe letzte 4 Zeilen aus 3.2 GPG-Key erstellen).
 
GPG_KEY=''''9627014B''''
GPG_PW='_GPG_PASSWORD_'
 
===Kompression und Art der Verschlüsselung festlegen===
 
Zusätzlich können in '''GPG_OPTS=''' weitere Optionen zur Kompression und Art der Verschlüsselung gesetzt werden.
 
GPG_OPTS='--compress-algo=bzip2 --personal-cipher-preferences AES256,AES192'
 
===Überprüfung GPG-Key und Passphrase===
 
duply prüft vor jeder Aktion ob der GPG-Key gültig ist und die Passphrase korrekt ist.
 
Dies kann durch die Option '''GPG_TEST='disabled'''' unterbunden werden.
 
Aktiviert
GPG_TEST='disabled'
 
Deaktiviert
# GPG_TEST='disabled'
 
===Ziel des Backups festlegen===
 
duply versteht alle gängigen Protokolle zur Datenübertragung.
 
Die Syntax des hosts ist wie folgt:
 
scheme://[user:password@]host[:port]/[/]path
 
===Protokoll zur Datenübertragung festlegen===
 
In der conf-Datei befindet sich eine Liste der unterstützten Protokolle und deren Syntax.
 
<nowiki># </nowiki>  file://[/absolute_]path
<nowiki># </nowiki>  ftp[s]://user[:password]@other.host[:port]/some_dir
<nowiki># </nowiki>  hsi://user[:password]@other.host/some_dir
<nowiki># </nowiki>  cf+<nowiki>http://container_name</nowiki>
<nowiki># </nowiki>  imap[s]://user[:password]@host.com[/from_address_prefix]
<nowiki># </nowiki>  rsync://user[:password]@other.host[:port]::/module/some_dir
<nowiki># </nowiki>  <nowiki># rsync over ssh (only keyauth)</nowiki>
<nowiki># </nowiki>  rsync://user@other.host[:port]/relative_path
<nowiki># </nowiki>  rsync://user@other.host[:port]//absolute_path
<nowiki># </nowiki>  <nowiki># for the s3 user/password are AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY</nowiki>
<nowiki># </nowiki>  s3://[user:password]@host/bucket_name[/prefix]
<nowiki># </nowiki>  s3+http://[user:password]@bucket_name[/prefix]
<nowiki># </nowiki>  <nowiki># scp and sftp are aliases for the ssh backend</nowiki>
<nowiki># </nowiki>  <nowiki>ssh://user</nowiki>[:password]@other.host[:port]/some_dir
<nowiki># </nowiki>  tahoe://alias/directory
<nowiki># </nowiki>  webdav[s]://user[:password]@other.host/some_dir
 
Hier ist anzumerken das Sonderzeichen urlencoded eingetragen werden müssen, außer sie werden in den Parametern <tt>TARGET_USER, TARGET_PASS</tt> eingetragen.
 
TARGET='scheme://user[:password]@host[:port]/[/]path'
 
Als nächstes kann mit der Option <tt>SOURCE=</tt> ''das Root-Verzeichnis für das Backup gesetzt werden.
 
Soll ein Backup aus mehreren Unterordnern von '''/''' bestehen (Bsp.: /etc /var /home sollen gesichert werden), so muss die SOURCE Variable auf '''/''' gesetzt werden.''
 
SOURCE='/'
 
Die Folgenden Parameter kontrollieren das maximale Alter und die Anzahl der vollständigen Backups die duply behalten soll.
 
Hier ist anzumerken, dass duply keine Backups löscht, sofern man es nicht anfordert.
 
Mit <tt>MAX_AGE</tt> wird das maximale Alter von Backups bestimmt.


=== Kommandos ===
{| class="wikitable sortable options"
|-
! Option !! Parameter ||Beschreibung
|-
| usage || || get usage help text
|-
| and/or/groupIn/groupOut || || pseudo commands used in batches (see SEPARATORS above)
|-
| create || || creates a configuration profile
|-
| backup || || backup with pre/post script execution (batch: [pre_bkp_post]), full (if full_if_older matches or no earlier backup is found) incremental (in all other cases)
|-
| pre/post || ||execute '<profile>/pre', '<profile>/post' scripts
|-
| bkp || || as above but without executing pre/post scripts
|-
| full || ||force full backup
|-
| incr || || force incremental backup
|-
| list || [<age>] || list all files in backup (as it was at <age>, default: now)
|-
| status || || prints backup sets and chains currently in repository
|-
| verify || [<age>] [--compare-data] || list files changed, since age if given
|-
| verifyPath || <rel_path_in_bkp> <local_path> [<age>] [--compare-data] || list changes of a file or folder path in backup compared to a local path, since age if given
|-
| restore || <target_path> [<age>] || restore the complete backup to <target_path> [as it was at <age>]
|-
| fetch || <src_path> <target_path> [<age>] || fetch single file/folder from backup [as it was at <age>]
|-
| purge || [<max_age>] [--force] || list outdated backup files (older than $MAX_AGE) [use --force to actually delete these files]
|-
| purgeFull || [<max_full_backups>] [--force] || list outdated backup files ($MAX_FULL_BACKUPS being the number of full backups and associated incrementals to keep, counting in reverse chronological order) [use --force to actually delete these files]
|-
| purgeIncr || [<max_fulls_with_incrs>] [--force] || list outdated incremental backups ($MAX_FULLS_WITH_INCRS being the number of full backups which associated incrementals will be kept, counting in reverse chronological order) [use --force to actually delete these files]
|-
| purgeAuto || [--force] || convenience batch wrapper for all purge commands above
* purge, purgeFull, purgeIncr are added if their conf vars were set
* e.g
  MAX_AGE=1Y
  MAX_AGE=1Y
MAX_FULL_BACKUPS=6
MAX_FULLS_WITH_INCR=3
in profile conf file would result in
[purge_purgeFull_purgeIncr]
|-
| cleanup || [--force] || list broken backup chain files archives (e.g
* after unfinished run) [use --force to actually delete these files]
|-
| changelog || || print changelog / todo list
|-
| txt2man || || feature for package maintainers - create a manpage based on the usage output
* download txt2man from https://mvertes.free.fr/, put it in the PATH and run 'duply txt2man' to create a man page
|-
| version || || show version information of duply and needed programs
|}


Mit <tt>MAX_FULL_BACKUPS</tt> kann bestimmt werden wieviele Full-Backups duply maximal behält.
=== Umgebung ===
 
=== Rückgabewert ===
MAX_FULL_BACKUPS=5
 
Alternativ kann mit <tt>MAX_FULLBKP_AGE</tt> spezifiert werden, wie alt ein Full-Backup sein darf, bevor ein neues Full-Backup erstellt wird.
 
MAX_FULLBKP_AGE=2W
DUPL_PARAMS="$DUPL_PARAMS --full-if-older-than $MAX_FULLBKP_AGE "
 
Um den durch eventuelle Übertragungsfehler entstehenden Zeitverlust einzuschränken teilt duply standardmäßig seine Backups in 25 MB große Dateien.
 
Dies kann mit dem <tt>VOLSIZE</tt> Parameter geändert werden.
 
VOLSIZE=10
DUPL_PARAMS="$DUPL_PARAMS --volsize $VOLSIZE "
 
Weiter lassen sich noch optionale Parameter wie VERBOSITY und TEMP_DIR setzen.
 
===conf-Datei befüllt===
 
# gpg encryption settings, simple settings:
#  GPG_KEY='disabled' - disables encryption alltogether
#  GPG_KEY='<key1>[,<key2>]'; GPG_PW='pass' - encrypt with keys,
#  sign if secret key of key1 is available use GPG_PW for sign & decrypt
#  Note: you can specify keys via all methods described in gpg manpage,
#        section "How to specify a user ID", escape commas (,) via backslash (\)
#        e.g. 'Mueller, Horst', 'Bernd' -> 'Mueller\, Horst, Bernd'
#        as they are used to separate the entries
#  GPG_PW='passphrase' - symmetric encryption using passphrase only
'''GPG_KEY='9627014B''''
'''GPG_PW='_GPG_PASSWORD_''''
# gpg encryption settings in detail (extended settings)
#  the above settings translate to the following more specific settings
#  GPG_KEYS_ENC='<keyid1>[,<keyid2>,...]' - list of pubkeys to encrypt to
#  GPG_KEY_SIGN='<keyid1>|disabled' - a secret key for signing
#  GPG_PW='<passphrase>' - needed for signing, decryption and symmetric
#  encryption. If you want to deliver different passphrases for e.g.
#  several keys or symmetric encryption plus key signing you can use
#  gpg-agent. Simply make sure that GPG_AGENT_INFO is set in environment.
#  also see "A NOTE ON SYMMETRIC ENCRYPTION AND SIGNING" in duplicity manpage
# notes on en/decryption
#  private key and passphrase will only be needed for decryption or signing.
#  decryption happens on restore and incrementals (compare archdir contents).
#  for security reasons it makes sense to separate the signing key from the
#  encryption keys. <nowiki>https://answers.launchpad.net/duplicity/+question/107216</nowiki>
#GPG_KEYS_ENC='<pubkey1>,<pubkey2>,...'
#GPG_KEY_SIGN='<prvkey>'
# set if signing key passphrase differs from encryption (key) passphrase
# NOTE: available since duplicity 0.6.14, translates to SIGN_PASSPHRASE
#GPG_PW_SIGN='<signpass>'
 
# uncomment and set a file path or name force duply to use this gpg executable
# available in duplicity 0.7.04 and above (currently unreleased 06/2015)
#GPG='/usr/local/gpg-2.1/bin/gpg'
 
# gpg options passed from duplicity to gpg process (default='')
# e.g. "--trust-model pgp|classic|direct|always"
#  or "--compress-algo=bzip2 --bzip2-compress-level=9"
#  or "--personal-cipher-preferences AES256,AES192,AES..."
#  or "--homedir ~/.duply" - keep keyring and gpg settings duply specific
#  or "--pinentry-mode loopback" - needed for GPG 2.1+ _and_
#      also enable allow-loopback-pinentry in your .gnupg/gpg-agent.conf
'''GPG_OPTS='--compress-algo=bzip2 --personal-cipher-preferences AES256,AES192''''
 
# disable preliminary tests with the following setting
'''GPG_TEST='disabled''''
# backend, credentials & location of the backup target (URL-Format)
# generic syntax is
#  scheme://[user[:password]@]host[:port]/[/]path
# eg.
#  <nowiki>sftp://bob:secret@backupserver.com//home/bob/dupbkp</nowiki>
# for details and available backends see duplicity manpage, section URL Format
#  <nowiki>http://duplicity.nongnu.org/duplicity.1.html#sect7</nowiki>
# BE AWARE:
#  some backends (cloudfiles, S3 etc.) need additional env vars to be set to
#  work properly, read after the TARGET definition for more details.
# ATTENTION:
#  characters other than A-Za-z0-9.-_.~ in the URL have to be
#  replaced by their url encoded pendants, see
#    <nowiki>http://en.wikipedia.org/wiki/Url_encoding</nowiki>
#  if you define the credentials as TARGET_USER, TARGET_PASS below duply
#  will try to url_encode them for you if the need arises.
TARGET='scheme://user[:password]@host[:port]/[/]path'
# optionally the username/password can be defined as extra variables
# setting them here _and_ in TARGET results in an error
# ATTENTION:
#  there are backends that do not support the user/pass auth scheme.
#  prominent examples are S3, Azure, Cloudfiles. when in doubt consult the
#  duplicity manpage. usually there is a NOTE section explaining if and which
#  env vars should be set.
#TARGET_USER='_backend_username_'
#TARGET_PASS='_backend_password_'
# eg. for cloud files backend it might look like this (uncomment for use!)
#export CLOUDFILES_USERNAME='someuser'
#export CLOUDFILES_APIKEY='somekey'
#export CLOUDFILES_AUTHURL ='someurl'
# the following is an incomplete list (<backend>: comma separated env vars list)
# Azure: AZURE_ACCOUNT_NAME, AZURE_ACCOUNT_KEY
# Cloudfiles: CLOUDFILES_USERNAME, CLOUDFILES_APIKEY, CLOUDFILES_AUTHURL
# Google Cloud Storage: GS_ACCESS_KEY_ID, GS_SECRET_ACCESS_KEY
# Pydrive: GOOGLE_DRIVE_ACCOUNT_KEY, GOOGLE_DRIVE_SETTINGS
# S3: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
# Swift: SWIFT_USERNAME, SWIFT_PASSWORD, SWIFT_AUTHURL,
#        SWIFT_TENANTNAME OR SWIFT_PREAUTHURL, SWIFT_PREAUTHTOKEN
# base directory to backup
SOURCE='/path/of/source'
# a command that runs duplicity e.g.
#  shape bandwidth use via trickle
#  "trickle -s -u 640 -d 5120" # 5Mb up, 40Mb down"
#DUPL_PRECMD=""
# override the used python interpreter, defaults to
#  - parsed result of duplicity's shebang or 'python2'
#  e.g. "python2" or "/usr/bin/python2.7"
#PYTHON="python"
# exclude folders containing exclusion file (since duplicity 0.5.14)
# Uncomment the following two lines to enable this setting.
#FILENAME='.duplicity-ignore'
#DUPL_PARAMS="$DUPL_PARAMS --exclude-if-present '$FILENAME'"
# Time frame for old backups to keep, Used for the "purge" command. 
# see duplicity man page, chapter TIME_FORMATS)
#MAX_AGE=1M
# Number of full backups to keep. Used for the "purgeFull" command.
# See duplicity man page, action "remove-all-but-n-full".
#MAX_FULL_BACKUPS=1
# Number of full backups for which incrementals will be kept for.
# Used for the "purgeIncr" command.
# See duplicity man page, action "remove-all-inc-of-but-n-full".
#MAX_FULLS_WITH_INCRS=1
# activates duplicity --full-if-older-than option (since duplicity v0.4.4.RC3)
# forces a full backup if last full backup reaches a specified age, for the
# format of MAX_FULLBKP_AGE see duplicity man page, chapter TIME_FORMATS
# Uncomment the following two lines to enable this setting.
#MAX_FULLBKP_AGE=1M
#DUPL_PARAMS="$DUPL_PARAMS --full-if-older-than $MAX_FULLBKP_AGE "
# sets duplicity --volsize option (available since v0.4.3.RC7)
# set the size of backup chunks to VOLSIZE MB instead of the default 25MB.
# VOLSIZE must be number of MB's to set the volume size to.
# Uncomment the following two lines to enable this setting.
#VOLSIZE=50
#DUPL_PARAMS="$DUPL_PARAMS --volsize $VOLSIZE "
# verbosity of output (error 0, warning 1-2, notice 3-4, info 5-8, debug 9)
# default is 4, if not set
#VERBOSITY=5
# temporary file space. at least the size of the biggest file in backup
# for a successful restoration process. (default is '/tmp', if not set)
#TEMP_DIR=/tmp
# Modifies archive-dir option (since 0.6.0) Defines a folder that holds
# unencrypted meta data of the backup, enabling new incrementals without the
# need to decrypt backend metadata first. If empty or deleted somehow, the
# private key and it's password are needed.
# NOTE: This is confidential data. Put it somewhere safe. It can grow quite
#      big over time so you might want to put it not in the home dir.
# default '~/.cache/duplicity/duply_<profile>/'
# if set  '${ARCH_DIR}/<profile>'
#ARCH_DIR=/some/space/safe/.duply-cache
# DEPRECATED setting
# sets duplicity --time-separator option (since v0.4.4.RC2) to allow users
# to change the time separator from ':' to another character that will work
# on their system.  HINT: For Windows SMB shares, use --time-separator='_'.
# NOTE: '-' is not valid as it conflicts with date separator.
# ATTENTION: only use this with duplicity < 0.5.10, since then default file
#            naming is compatible and this option is pending depreciation
#DUPL_PARAMS="$DUPL_PARAMS --time-separator _ "
# DEPRECATED setting
# activates duplicity --short-filenames option, when uploading to a file
# system that can't have filenames longer than 30 characters (e.g. Mac OS 8)
# or have problems with ':' as part of the filename (e.g. Microsoft Windows)
# ATTENTION: only use this with duplicity < 0.5.10, later versions default file
#            naming is compatible and this option is pending depreciation
#DUPL_PARAMS="$DUPL_PARAMS --short-filenames "
# more duplicity command line options can be added in the following way
# don't forget to leave a separating space char at the end
#DUPL_PARAMS="$DUPL_PARAMS --put_your_options_here "
 
==Pre- und Post-Skripte==
 
duply erlaubt die Verwendung von Pre- und Post-Skripten.
 
Das pre-Skript wird direkt vor dem Backup ausgeführt, das post-Skript direkt nach dem Backup.
 
Mit diesen Skripten können beispielsweise Snapshots von LVM-Volumes oder Dumps von SQL Datenbanken gemacht und in das Backup einbezogen werden.
 
Die files <tt>pre</tt> und <tt>post</tt> müssen im jeweiligen duply Verzeichnis liegen (Bsp.: /home/user/.duply/backup/) und ausführbar sein.
 
Werden die pre/post Scripte nicht wie erhofft ausgeführt (z.B. bei den Sicherchungs-Methoden "full/incr"), können diese explizit angegeben werden: <tt>pre_incr_post</tt>
 
===Beispiel===
Hier ein Beispiel für ein PRE/POST Skript welches vor dem Backup einen SQL-Dump aller Datenbanken erstellt und diesen nach dem Backup wieder löscht.
 
====pre-Datei====
 
/usr/bin/mysqldump --all-databases -u root -ppw> /tmp/sqldump-$(date '+%F')
 
====post-Datei====
 
/bin/rm /tmp/sqldump-$(date '+%F')
 
==exclude==
 
duply arbeitet standardmäßig mit einer Whitelist.
 
Um gewisse Verzeichnisse oder Dateien von einem Backup zu inkludieren muss die Datei <tt>exclude</tt> im duply Verzeichnis erstellt werden.
 
Die Syntax erlaubt das Hinzufügen von Verzeichnissen und Dateien mit einem <tt>+ /pfad/zur/datei</tt>.
 
Um ein Verzeichnis zu exkludieren muss in der <tt>exclude</tt> ein <tt>- /pfad/zum/Verzeichnis</tt> eingefügt werden.
 
Zudem erlaubt duply die Verwendung von Wildcards.
 
Die hier dargestellte <tt>exclude</tt> Datei sichert die Verzeichnisse <tt>/etc/, /root/, /var/www/</tt> und exkludiert alle anderen Verzeichnisse.
 
+ /etc/
+ /root/
+ /var/www/
- **
 
==Parameter==
 
duply bietet eine Vielzahl von Kommandozeilenparametern für die Sicherung und Wiederherstellung von Daten.
 
Die gesamte Liste ist in der Manpage von duply zu finden.
 
Beim Einsatz von mehreren Parameter werden diese durch einen Unterstrich ('''_''') getrennt.
 
Mit <tt>/usr/bin/duply /root/.duply/test full_verify_purge --force</tt> wird ein volles Backup erstellt, verifiziert und alte Backups gelöscht.
 
Backups welche die <tt>MAX_AGE</tt> überschritten haben werden mit <tt>purge</tt> angezeigt und durch die zusätzliche Option <tt>--force</tt> gelöscht.
 
Der Befehl <tt>/usr/bin/duply /root/.duply/test incr</tt> führt ein inkrementelles Backup aus.
 
==cronjob==
 
Bei duply handelt es sich nicht um einen Dienst (Daemon), sondern um ein Skript, das z.B. regelmäßig via Cron ausgeführt werden kann.
 
Eine Beispielhafte cronjob-Konfiguration wäre:
 
0 0 * * 7 /usr/bin/duply /root/.duply/test full_verify_purge --force
0 0 * * 1-6 /usr/bin/duply /root/.duply/test incr
 
In dieser Konfiguration wird Sonntags um 0:00 ein Full-Backup erstellt und alte Backups gelöscht.
 
Montag bis Samstag wird jeden Tag ein inkrementelles Backup durchgeführt.
 
Neue cronjobs können mit '''crontab -e''' erstellt werden.
 
Hier ist anzumerken, dass für alle Kommandos und Konfigurationsdateien der absolute Pfad angegeben werden muss.


=Weitere Informationen=


* [http://duply.net/ duply] (duply.net)
<noinclude>


=Quellen=
== Anhang ==
=== Siehe auch ===
{{Special:PrefixIndex/{{BASEPAGENAME}}/}}
----
* [[GnuPG]]
* [[GnuPG-Agent]]
* [[pinentry-curses]]
* [[duplicity]]


* [https://www.thomas-krenn.com/de/wiki/Backup_unter_Linux_mit_duply https://www.thomas-krenn.com/de/wiki/Backup_unter_Linux_mit_duply]
==== Sicherheit ====
=== Dokumentation ===
=== Links ===
==== Projekt ====
==== Weblinks ====
# [https://www.thomas-krenn.com/de/wiki/Backup_unter_Linux_mit_duply https://www.thomas-krenn.com/de/wiki/Backup_unter_Linux_mit_duply]
# [https://wiki.archlinux.org/index.php/Duply#Configuration https://wiki.archlinux.org/index.php/Duply#Configuration]
# [https://www.gnupg.org/howtos/de/GnuPGMiniHowto.html https://www.gnupg.org/howtos/de/GnuPGMiniHowto.html]
# [https://duply.net/ duply.net]


* [https://duply.net/duply_(simple_duplicity) https://duply.net/duply_(simple_duplicity)]
[[Kategorie:duply]]


{{DISPLAYTITLE:duply}}


[[Category:Sicherheit:Backup]]
</noinclude>
[[Kategorie:Linux/Befehl]]

Aktuelle Version vom 11. Mai 2025, 13:42 Uhr

duply - Inkrementelle verschlüsselte Backups

Beschreibung

Frontend für duplicity

Shell-Frontend für duplicity

  • Verwendung vereinfachen
  • Einstellungen in Profilen verwalten
  • Stapelverarbeitung
    • Es unterstützt die Ausführung von mehreren Befehlen als Stapelverarbeitung
    • Damit sind einzeilige cron-Einträge möglich und der Benutzer kann Skripte verwenden, die vor oder nach dem Backup ausgeführt werden
  • Alle duplicity-Backends werden unterstützt
Vereinfacht die Ausführung von Duplicity

Frontend für duplicity

  • Backups können lokal oder einem anderen System gespeichert werden
  • Cron oder Kommandozeile
  • Speichert Einstellungen in Profilen
  • Batch-Operationen
    ermöglicht, beispielsweise backup_verify+purge
  • Ausführung von Pre-/Post-Skripten
  • verschiedene Aktionen möglich, abhängig vom vorherigen oder nächsten Befehl oder dessen Rückgabewert
  • Vorbedingungsprüfung für fehlerfreie Duplizitätsoperationen

Für jeden Sicherungsauftrag wird ein Konfigurationsprofil erstellt

Profilordner
~/.duply/<profile>
Hinweis
Wenn der Ordner '/etc/duply' existiert, werden die Profile für den Superuser Benutzer root dort gesucht und erstellt werden
Protokolle
Protokoll Beschreibung
ftp
ssh
s3
rsync
cifs
webdav
http

Installation

sudo apt install duply

Dateien

/usr/bin/
duply
/usr/share
/doc/duply/
 README
 README.Debian
 TODO
 changelog.Debian.gz
 changelog.gz
 copyright
 systemd-unit.examples
  HOWTO.txt
  systemd-unit.examples/system/
   duply-backup@.service
   duply-backup@.timer
   duply-cleanup@.service
   duply-cleanup@.timer
   duply-verify@.service
   duply-verify@.timer
   notify-failed-backup@.service
  systemd-unit.examples/user/
   duply-backup@.service
   duply-backup@.timer
   duply-cleanup@.service
   duply-cleanup@.timer
   duply-verify@.service
   duply-verify@.timer
   notify-failed-backup@.service
 man/man1/
  duply.1.gz

Aufruf

Argumente

Optionen

Option Beschreibung
--force passed to duplicity (see commands purge, purgeFull, purgeIncr, cleanup)
--preview do nothing but print out generated duplicity command lines
--disable-encryption disable encryption, overrides profile settings

Kommandos

Option Parameter Beschreibung
usage get usage help text
and/or/groupIn/groupOut pseudo commands used in batches (see SEPARATORS above)
create creates a configuration profile
backup backup with pre/post script execution (batch: [pre_bkp_post]), full (if full_if_older matches or no earlier backup is found) incremental (in all other cases)
pre/post execute '<profile>/pre', '<profile>/post' scripts
bkp as above but without executing pre/post scripts
full force full backup
incr force incremental backup
list [<age>] list all files in backup (as it was at <age>, default: now)
status prints backup sets and chains currently in repository
verify [<age>] [--compare-data] list files changed, since age if given
verifyPath <rel_path_in_bkp> <local_path> [<age>] [--compare-data] list changes of a file or folder path in backup compared to a local path, since age if given
restore <target_path> [<age>] restore the complete backup to <target_path> [as it was at <age>]
fetch <src_path> <target_path> [<age>] fetch single file/folder from backup [as it was at <age>]
purge [<max_age>] [--force] list outdated backup files (older than $MAX_AGE) [use --force to actually delete these files]
purgeFull [<max_full_backups>] [--force] list outdated backup files ($MAX_FULL_BACKUPS being the number of full backups and associated incrementals to keep, counting in reverse chronological order) [use --force to actually delete these files]
purgeIncr [<max_fulls_with_incrs>] [--force] list outdated incremental backups ($MAX_FULLS_WITH_INCRS being the number of full backups which associated incrementals will be kept, counting in reverse chronological order) [use --force to actually delete these files]
purgeAuto [--force] convenience batch wrapper for all purge commands above
  • purge, purgeFull, purgeIncr are added if their conf vars were set
  • e.g
MAX_AGE=1Y
MAX_FULL_BACKUPS=6
MAX_FULLS_WITH_INCR=3

in profile conf file would result in 

[purge_purgeFull_purgeIncr]
cleanup [--force] list broken backup chain files archives (e.g
  • after unfinished run) [use --force to actually delete these files]
changelog print changelog / todo list
txt2man feature for package maintainers - create a manpage based on the usage output
version show version information of duply and needed programs

Umgebung

Rückgabewert

Anhang

Siehe auch

Sicherheit

Dokumentation

Links

Projekt

Weblinks

  1. https://www.thomas-krenn.com/de/wiki/Backup_unter_Linux_mit_duply
  2. https://wiki.archlinux.org/index.php/Duply#Configuration
  3. https://www.gnupg.org/howtos/de/GnuPGMiniHowto.html
  4. duply.net
Abgerufen von „https://wiki.foxtom.de/index.php?title=Duply&oldid=141430“