blog.6admin.io
guest@6admin.io:~$
backup, rsync, ssh

SSH: secure rsync

Rsync is the incremental backup tool: it compares source and destination, transfers only deltas and preserves permissions, timestamps, symlinks. Over SSH, it traverses the network on the encrypted channel, without an rsync daemon on the server side (SSH does the transport).

The basic rsync

rsync -avz /data/ user@server:/backup/data/
  • -a : archive mode (recursive, preserves perms, times, symlinks, devices)
  • -v : verbose (lists transferred files)
  • -z : compression (gzip before transfer)

The / after /data/ means: “the contents of /data”, not “/data itself”. Without the /, rsync creates /backup/data/data/. This is the most common rsync mistake.

The options that change everything

rsync -avz --delete --exclude='.svn' --exclude='*.tmp' \
      --link-dest=/backup/data.prev \
      /data/ user@server:/backup/data.new/
  • --delete : removes files that no longer exist at the source (without it, deleted files stay in the backup, the backup grows indefinitely)
  • --exclude : excludes patterns (SVN, temp files, cache)
  • --link-dest : hardlink to the previous backup (unchanged files are hardlinks to the previous version: the incremental backup only costs the changed files)

With --link-dest, every incremental backup is a full snapshot, but disk space used is only the files modified since the last one. This is the Time Machine pattern, before Time Machine.

The restricted SSH key

The backup server has a restricted SSH key (previous article: authorized_keys) that authorizes ONLY rsync. The backup machine cannot connect in shell, cannot run other commands, cannot do anything but rsync:

command="rsync --server --daemon .",no-port-forwarding,no-pty ssh-rsa AAAA...

The backup script

#!/bin/bash
DATE=$(date +%Y%m%d)
PREV=/backup/data.$(ls -1t /backup/ | grep data. | head -2 | tail -1 | sed 's/\.//')
DEST=/backup/data.$DATE
rsync -avz --delete --link-dest=$PREV /data/ root@backup:$DEST/

This script creates a dated backup, hardlinked to the previous one. Run in cron (every day at 2am), it produces a series of snapshots with incremental backup disk usage.