9.2 KiB
Description
This is a simple bash 4.2+ script for archiving given folders to untrusted and/or unreliable locations. Folders provided are compressed and symmetrically AES encrypted.
A predefined amount of redundant information is added as separate files to ensure recoverability in case of bitrot or transmission errors. Archives are simply distinguished by placing them inside a unix timestamp labeled target directory. The script contains a more than usual amount of error detection and handling to keep your data as safe as possible. Log files are created in the working directory.
This script was initially designed to backup master password databases and security critical files, including GnuPG private keys, SSL certificates, crypto currency wallets et cetera.
Always do a test run with noncritical data at first.
Utilities required (using default compressor)
gpg tar find xz
Optional (depends on features used)
ssh par2 rsync rclone scp pass
Configuration
The configuration file is a shell script sourced from $XDG_CONFIG_HOME/backup/bfrg/config
by default.
List of options
Option | Type | Default | Description |
BLK_LOCAL_TARGETS | A | ( ) |
Local block targets |
SCP_REMOTE_TARGETS | A | ( ) |
_scp_ remote targets |
RSYNC_REMOTE_TARGETS | A | ( ) |
_rsync_ remote targets. Uses ssh for transport |
RCLONE_REMOTE_TARGETS | A | ( ) |
_rclone_ targets. Requires existing rclone configuration |
ARCHIVE_NAME | V | archive_${SCRIPT_EPOCH}.tar.xz |
Output file |
LOG_FILE | V | bfrg_${SCRIPT_EPOCH}.log |
Log file |
ARCHIVE_CLEANUP | V | 1 |
Cleanup old archived on block targets (only works with BLK) |
KEEP_DAYS | V | 365 |
Days to keep archives. Ensures that one last archive is available at all times |
SELF_REPLICATE | V | 1 |
Copy script to the target for later reference |
SAFE_DELETE | V | 1 |
Use *shred* before deleting temporary files, recommended if SAFE_TMP is on a hard disk |
DATA_REDUNDANCY | V | 5 |
Add n% recovery data |
VERBOSE | V | 1 |
Be verbose |
NON_INTERACTIVE | V | 0 |
Prompt user on error |
ERROR_ABORT | V | 0 |
Stop processing targets on error in non-interactive mode |
SAFE_TMP | V | /tmp |
Temporary directory. Volatile storage recommended. |
COMPRESSOR_CMD | A | ( xz --q -9e --threads=0 -v ) |
Compressor and its arguments being used for compression |
EXCLUDE_LIST | A | ( 'System Volume Information' ' *~' '#*#' '.#* ' 'tmp' '.tmp' '.nv' 'GPUCache' '.ccache' '.cache' '.var' ) |
From archiving excluded directories |
RCLONE_TASKS | V | 2 |
Concurrent rclone tasks |
GPG_CIPHER | V | AES256 |
Encryption cipher |
GPG_DIGEST | V | SHA512 |
Encryption digest |
GPG_MANGLE_MODE | V | 3 |
Mangle mode |
GPG_MANGLE_ITERATIONS | V | 65011712 |
Mangle iterations |
PASS_KEY | V | bfrg |
Password manager lookup key |
PASS_CMD | A | ( pass ) |
Password manager lookup command with arguments |
Notes
For cloud target locations (Google Drive, Amazon S3, OneDrive etc.), rclone, with the desired services already configured, is a prerequisite. For adding optional redundant information (enabled by default), par2cmdline, available in the default repositories of Debian, Fedora and Arch Linux and most other distributions, is used.
The recovery script takes an encrypted archive as argument and tries to repair it if necessary, as far as redundant information is present, before unpacking it into the current working directory.
Example configuration
# secure temporary file location, volatile (tmpfs) or encrypted location should be preferred
SAFE_TMP=~/.tmp
# source folders to include in the archive
SOURCE_PATHS=( ~/mysecrets )
# block layer targets where the final archive is copied to
BLK_LOCAL_TARGETS=( ~/backup/secrets /media/data/backup /run/media/${USER}/FLASH_DRIVE )
# rsync targets, ssh is used for transport
RSYNC_REMOTE_TARGETS=( ${USER}@remote.example.org:/homes/${USER}/rsync_backup/secrets )
# rclone cloud targets, all rclone backends are supported
RCLONE_REMOTE_TARGETS=( 'Backblaze:rclonebak/secrets' 'OneDrive:_backup/secrets' 'GoogleDrive:_backup/secrets' 'Dropbox:_backup/secrets' )
# non-interactive mode, count and log errors but proceed without asking questions - useful for automation
NON_INTERACTIVE=1