Deploying Suse Linux Enterprise Server

Purchase "Deploying Suse Linux Enterprise Server"
at Lulu.com

Deploying BackupPC on SLES

SLES10 Setup

For this guide I won't cover the basics of installing SLES10, the installation manual should provide enough instruction to get it installed. However here are some tips to alleviate some issues that might come up.

First, you will definitely want to use some sort of RAID array to store the backups on - not only will this provide redundancy, but it also increases the amount of storage space you will be able to use. The BackupPC program will use compression, but you will also want to store numerous "versions" of your files on this server. Also the number of computers you backup has a big impact on the amount of space you need for this server (although not as much as you think). Personally on most of my deployments I setup BackupPC to backup just about every computer in an organization.

Also, if you are going to "Archive" backups to removable media (such as DVDs or Tape) you will also want to make sure you will have enough space on the server to store an additional backup of the computer. For example, if you have 100GB of Data on one of your servers, make sure you have at least that amount free on the BackupPC Server before attempting to do an Archive of that Server (more on this later). If you are unsure of exactly how much storage space you will need, always over-estimate the amount, or at least use a filesystem or disk partition that you will be able to increase later on, such as a LVM filesystem.

For this guide, I will assume that your backups will be stored on a separate filesystem mounted at "/srv" on the BackupPC Server.

Creating the BackupPC User

For security reasons, you will want to create a separate user that will run BackupPC. To do this simply Launch Yast and go to the "User Management" module. The user we will add will be a "system user", so adjust the filter to view the "System Users", then click Add.

Displaying the System Users and Adding the "backuppc" System User

Fill in all the required entries, here are the entries that I usually use:

Username: backuppc
Check "Disable User Logins"
Home Directory: /srv/backuppc
Logon Shell: /bin/false
Default Group: www

For the default group, you may want to also create a "group" that BackupPC is run under, however running it as the "www" group should provide enough security for most sites. Note that we will adjust the permissions on the backup directory to reduce security risks.

Installing and Configuring Apache

The BackupPC application utilizes the Apache Web Server to allow for an easy interface to it's functionality. To install Apache under Suse Linux Enterprise Server, simply launch Yast and go to the "Software Management" module. Once the module is running, you will want to change the filter so it will display "Patterns". To install apache and all of the required libraries, simply check the "Web and LAMP Server" box under the primary functions section. Click on Accept to install the software.

Installing Apache using Yast and Enabling Perl Support for Apache

To setup Apache for use with BackupPC, launch the "HTTP Server" Yast Module. The first time the module is launched you will be presented with a "Wizard" that will step you through setting up Apache. Within the wizard make sure you enable the "Perl Scripting" Module, as BackupPC makes heavy use of this. You can step through the rest of the wizard and upon exit Yast should install all the required software packages it needs, just make sure you enable Apache to start upon restart.

Now we will want to configure Apache to enforce users to enter a Username and Password when accessing the backuppc website. To do this re-launch the "HTTP Server" Yast Module and go to the "Default Host" tab (Main Host tab with SP1 and later).

Editing the cgi-bin Directory and enabling Authconfig for User Authentication

What you will need to do is edit the "Directory" entry for "/srv/www/cgi-bin". In order to enable the authentication that we will use, set the Configuration to read:

AllowOverride	AuthConfig
Options		+ExecCGI -Includes
Order		Deny,Allow

What this will do is allow us to include a file within the cgi-bin directory that will require credentials before the site will appear. There are many different ways to do this with Apache, some might be better than others, but I chose to do it this way for a few reasons. First, it is pretty easy to setup. Second, in case of emergency you do not want to rely on any other server to access the site. If you authenticate against an LDAP server and that server is not available, you must reconfigure the BackupPC Server to allow all connections just so you can restore a good LDAP database, this would not be a good thing.

Creating the .htaccess File and Allowing Access

Now that we have setup Apache to allow the cgi-bin directory to be able to authenticate users, we now have to implement that feature. To do this you will need to create a text file called ".htaccess" within the /srv/www/cgi-bin/ directory. This file should contain:

AuthType Basic
AuthName "Username / Password Required"
AuthUserFile /srv/backuppc/password.file
Require valid-user

Now you will need to add every user that you will want to have access to the BackupPC Web Interface to the /srv/backuppc/password.file - to do this you simply run the following command:

htpasswd2 -c /srv/backuppc/password.file adminuser

to add the first user and any additional users can be added with:

htpasswd2 /srv/backuppc/password.file username

Warning: The BackupPC interface does not abide by ACLs or standard file/directory permissions (although during a Restore the ACLs and permissions will be restored)- anyone who has access a specific computer through the Web Interface has the ability to access ANY file that is backed up from that computer.

Configuring Apache to Run as the BackupPC User

For BackupPC's web interface to function properly, you must configure Apache to be ran as the "backuppc" user. To do this you need to edit the /etc/apache/uid.conf file so it looks similar to:

User backuppc
Group www

Ensure you restart Apache after you make this change.

Finishing up SLES Configuration

There are only a few more things you will want to do before installing BackupPC. The first on is to install all the required software that BackupPC uses. To do this first install perl-Archive-Zip and perl-Compress-Zlib with the following command:

yast -i perl-Archive-Zip perl-Compress-Zlib

Next is to install perl-File-RsyncP. This package is not on the Installation media, but I created an RPM package to ensure easy installation of BackupPC. To get this package and install it simply do:

wget http://www.pcc-services.com/sles/backuppc/perl-File-RsyncP-0.68-SLED.v1.i586.rpm
yast -i perl-File-RsyncP*

Now that all of the requirements are done, here are some other things you might want to do:

Setup NTP Client to get correct Time/Date - Yast - Network Services - NTP Client
Update your SLES Install - Yast - Software Management - Online Update, or you can run "zen-updater" and follow the prompts.