From YobiWiki
Jump to navigation Jump to search


  • apt-get install apache2 backuppc libfile-rsyncp-perl
  • add to /etc/aliases
backuppc: root

If you use a dedicated disk or partition:

  • prefer reiserfs over ext3 to avoid any inode shortage problem.
  • mount it with "noatime" for better performances
  • If you've to move an existing setup, move /var/lib/backuppc to the dedicated partition but preserve hardlinks (use cp -a), then create /var/lib/backuppc symlink

To create/change http passwords:

 htpasswd /etc/backuppc/htpasswd backuppc

To create a new user:

htpasswd /etc/backuppc/htpasswd user

add to /etc/aliases


To prepare backuppc to access the hosts:

su - backuppc
ssh-keygen -t rsa -N ''

For a full restoration from scratch, see the backuppc paragraph in Harddrive

Whenever you change the config files, be sure to have the proper permissions:

chown backuppc:www-data /etc/backuppc/*
chmod go-rwx /etc/backuppc/*pl


ln -s /etc/backuppc/apache.conf /etc/apache2/sites-enabled/backuppc

Add a host for backup

  • add it to /etc/backuppc/hosts
  • create a file such as /etc/backuppc/<host>.pl with the same name and with variables from that you want to adapt for your host
  • scp /var/lib/backuppc/.ssh/ root@<host_to_backup>:
  • on the host:
    • cat >> ~/.ssh/authorized_keys
    • prepend the line in authorized_keys by sth like
      so that only the backup host can log with this key.
    • install a ssh server if not yet done
    • install rsync
  • Try once as user backuppc to log as root on your host, first to accept the fingerprint, second to check if you are in without prompt for pwd
  • Reload hosts in backuppc: /etc/init.d/backuppc reload


Backup failed and you've only a very poor error message?

For example:

Got fatal error during xfer (Unable to read 4 bytes)

There are more complete logfiles in /var/lib/backuppc/pc/*yourmachine*/XferLOG.bad.z
But they're compressed with libz (I think) so to read the file:

$ /usr/share/backuppc/bin/BackupPC_zcat /var/lib/backuppc/pc/*yourmachine*/XferLOG.bad.z

To continue on the same example, here we got:

full backup started for directory /blabla
Running: /usr/bin/ssh -q -x -l root yourmachine /usr/bin/rsync --server --sender --numeric-ids --perms --owner --group -D --links --hard-links --times --block-size=2048 --recursive --bwlimit=1500 --ignore-times . /blabla
Xfer PIDs are now 10100
Read EOF: Connection reset by peer
Tried again: got 0 bytes
Done: 0 files, 0 bytes
Got fatal error during xfer (Unable to read 4 bytes)
Backup aborted (Unable to read 4 bytes)
Not saving this as a partial backup since it has fewer files than the prior one (got 0 and 0 files versus 0)

Ok ssh command failed. Let's try it:

# su - backuppc
$ /usr/bin/ssh -l root yourmachine ls
The authenticity of host 'yourmachine (' can't be established.
RSA key fingerprint is bl:ab:la
Are you sure you want to continue connecting (yes/no)? yes

So that's was the issue! That's what happen when you miss the last step in the paragraph about adding a host, just here above!

To invert tunnelling (if from behind a firewall)

  • On the host:
    • ssh -R 2222:localhost:22 <backup_server>
      Make it passwordless with keys
    • To make it automated: install autossh
      Add somewhere in the startup scripts:
      su <my_local_user> -c 'autossh -N -f -M 29001 -R 2222:localhost:22 <backup_server>' &
    • Or in /etc/network/interfaces
      up su <my_local_user> -c 'autossh -N -f -M 29001 -R 2222:localhost:22 <backup_server>' &
      down su <my_local_user> -c 'killall autossh'
  • On the server:
    • backuppc ~/.ssh/config:
      • Host <host_to_backup_as_said_to_backuppc>
      • ~HostName <localhost or ip_pub for vservers>
      • Port 2222


Deleting backups

I was used to do it manually but there is a nice script here, probably handling it less wildly than what I did...


When upgrading to rsync 2.6.7 on the clients you could face some problems.
This is due to a different interpretation of the option --devices
Use -D instead for sth compatible with all rsync versions.
Change it in and other host config files: $Conf{RsyncArgs} and $Conf{RsyncRestoreArgs}

Notes on new install

On the Fit PC


  • VG fitpc-vg
    • LV swap 2G => crypto; random key
      • swap
    • LV root 23G => ext4; label ROOT; use as /
    • LV home 500G => crypto
      • ext4; label HOME; use as /home; noatime,nodirtime; usage:news (more inodes)

Mounting encrypted home & swap failed during install -> mark them as "do not use" and see later.

  • web server ; ssh server ; standard utils


Encrypt swap:

Create /etc/crypttab

 cswap1          /dev/disk/by-id/dm-name-fitpc--vg-swap       /dev/urandom    swap,cipher=aes-xts-plain64,size=256,hash=sha1

Add to /etc/fstab

 /dev/mapper/cswap1  none        swap    sw            0       0

Mount and format

 cryptdisks_start cswap1
 mkswap /dev/mapper/cswap1 

Activate swap

 swapon -a

Handle encrypted home:

Add to /etc/crypttab

 home_crypt      /dev/disk/by-id/dm-name-fitpc--vg-home       none luks,noauto

Add to /etc/fstab

 /dev/mapper/home_crypt     /home_crypt     ext4    noatime,nodiratime,noauto,errors=remount-ro 0 0

Create fs

 cryptdisks_start home_crypt
 mkfs.ext4 -i 4096 /dev/mapper/home_crypt
 mount /home_crypt

Edit /etc/hosts fitpc fitpc

Install stuff

 apt-get install mc screen backuppc 

Move backuppc

 systemctl disable backuppc
 /etc/init.d/backuppc stop
 cp -a /var/lib/backuppc/ /home_crypt/
 rm -rf /var/lib/backuppc/
 ln -s /home_crypt/backuppc /var/lib/
 /etc/init.d/backuppc start

/root/backuppc :

 cryptdisks_start home_crypt
 mount /home_crypt
 /etc/init.d/backuppc start

Fix /etc/backuppc/apache.conf:

Options ExecCGI FollowSymlinks
Options +ExecCGI +FollowSymlinks


service apache restart

Update web passwd and create key:

htpasswd /etc/backuppc/htpasswd backuppc
su - backuppc
ssh-keygen -t ed25519 -N 


apt-get install lm-sensors sensord
sensors-detect # use default, no need for optional scans
# -> coretemp
echo -e "chip \"acpitz-virtual-0\"\n        ignore temp1\n        ignore temp" > /etc/sensors.d/fitpc-sensors.conf

Read sensors:

Adapter: Virtual device

Adapter: ISA adapter
Core 0:       +51.0°C  (crit = +90.0°C)

Edit /etc/default/sensord

service sensord restart

Emails: Change /etc/exim4/update-exim4.conf.conf

service exim4 restart

Change /etc/email-addresses (= From:)

root: some_valid_email
backuppc: some_valid_email

Add to /etc/aliases (= To: for backuppc users)

myuser: some_valid_email

Edit /etc/mailname

Fix localhost backup (auth errors):

apt-get install sudo
echo "backuppc ALL = NOPASSWD: /bin/tar" > /etc/sudoers.d/backuppc

Then edit /etc/backuppc/

$Conf{TarClientCmd} = '/usr/bin/env LC_ALL=C $tarPath -c -v -f - -C $shareName'
$Conf{TarClientCmd} = '/usr/bin/env LC_ALL=C /usr/bin/sudo $tarPath -c -v -f - -C $shareName'

Add a machine:

  • Add machine in /etc/hosts
192.168.x.x mymachine
  • From machine: (assuming fitpc2 is in its /etc/hosts, warning some devices don't seem to support the "from=")
sudo apt-get install openssh-server rsync
(echo -n "from=\"<IP_of_fitpc2>\" ";ssh root@fitpc2 cat /var/lib/backuppc/.ssh/ |sudo tee -a /root/.ssh/authorized_keys
  • Test from the server twice (once to accept fingerprint, once to check):
su -c "ssh root@mercure_eth" - backuppc
  • Add it to /etc/backuppc/hosts
mymachine 0       myuser   backuppc
  • Create a file /etc/backuppc/<host>.pl with the same name as in /etc/hosts and /etc/backuppc/hosts and with variables from that you want to adapt for your host
  • Reload
service backuppc reload