Category Archives: In English

Backing up in Linux

I’ve been managing many Windows and Unix servers in the last 10 years, and this I know for sure – backing up in Windows can be a painful experience, and most of the time it require significant investment in special backup software (which tend to cost thousands of dollars, usually more).
Even then, the software will become buggy once you start setting up complex backup scenario.

In Unix/Linux however, you have powerful scripting tools at your disposal, usually already included in the package. These tools are very flexible, enabling you to develop almost any kind of backup scheme.
It does require some sort of programming skill. Point-and-click admins will have a hard time at first, but let me tell you, do give it a try. You’ll find that it’s very much worth the trouble.

Both require investment in time & effort to develop a good backup strategy.

Before we progress, first here’s a few rules in regard to backup :

  • You can never have too many backups.
    I backed up my personal data to several locations – my other PC, and also my brothers’ PC. So in total, I have 3 copies of it.
    One day, the hard drive in my main PC broke down. So I came to my brother, and asked him to copy my data which is in his PC. To my surprise, he said that his hard drive just died too. I ended up with only a single copy of my precious data.
    I quickly replaced the dead hard drive, restored the only copy of my data there, and made a new backup script for it. Nowadays, my data is usually available in 5 or more locations.
  • Automate all of its processes.
    If it require even the tiniest amount of manual intervention, believe me, it will end up not being executed. For once of twice, you may still willing to intervene. But when you need to do that everyday, it just won’t happen.
  • Check your backup.
    Check the result / logs everyday. Try restoring the backup about every week. Do NOT skip this, or you will find out that the backup is actually not restorable when that very important server died on you.

These are the most important ones, and I confess to have suffered from one or more of it in the past.
You don’t have to, but it’s your choice.

Anyway, here’s a sample script to get you started backing up in Linux.

Backing up the whole hard drive, over the network.

#!/bin/bash
mkdir /mnt/backup
mount -t ext3 /dev/hdb1 /mnt/backup
chmod 777 /mnt/backup
cd /mnt/backup
/usr/bin/rsync -avuz --progress --rsh="ssh -l root -i /root/.ssh/id_dsa" 192.168.0.1:/ /mnt/backup

The 1st line is important – it tells the computer that we’d like this script to be processed by bash. Different shell has different syntax. So we need to be precise about this.

The 2nd line create the directory for mounting the backup drive. 3rd line mounts /dev/hdb1 (first partition of second IDE device) to /mnt/backup. 4th line gives full access to the drive. the 6th line does the actual backup process, copying only changed files on 192.168.10.101 to /mnt/backup.

It may seem simple at first, but make no mistake, rsync is one powerful tool. For example, quoted from rsync manual:

The rsync remote-update protocol allows rsync to transfer just the differences between two sets of files across the network connection, using an efficient checksum-search algorithm described in the technical report that accompanies this package.

This capability has enabled me to backup a 200 GB hard drive, over 100 Mbps network, in under 2 hours.
Without disturbing the 15+ users which are on that network as well. Simply amazing.

The next one is probably the kind of backup script you’d more often encounter – backup, compress, store to a safe location.


#!/bin/bash
tar cvf /backup/accounting-$(date +%Y%m%d).tar /home/accounting
bzip2 -9 /backup/accounting-$(date +%Y%m%d).tar
/usr/bin/scp -2 -i ~/.ssh/id_dsa /backup/accounting-$(date +%Y%m%d).tar.bz2 smith@192.168.0.10:/data/backup/

The 2nd line bundles up the whole content of /home/accounting into a single file named /backup/accounting-(today’s date).tar; example; /backup/accounting-20061230.tar would be the resulting file if this script is run on the 30th December 2006.
This trick needed to avoid the backup replacing the same file everytime it runs. This way, we’ll have multiple backups over time, instead of just one.

The 3rd line compresses the file above, as strong as possible (with the -9 switch)
The last line copies the file (now with .bz2 extension after compressed by bzip2) into directory /data/backup/ in a server with IP address of 192.168.0.10, as user smith.

The last example is a more complicated backup script.
I developed this to backup groups.or.id‘s (kinda like Yahoogroups) member database automatically, everyday to servers on different countries. Therefore, in case of disaster, the administrator can quickly restore the service on another server with little problem.

Backup member database, over the Internet.


#!/bin/bash
daftar_milis=( $(ls ~/) )

for element in $(seq 0 $((${#daftar_milis[@]} - 1)))
do

echo "---- MILIS: ${daftar_milis[$element]} ----" >> /backup/daftar-member-$(date +%Y%m%d).txt
/usr/bin/ezmlm-list ~/${daftar_milis[$element]} >> /backup/daftar-member-$(date +%Y%m%d).txt

done

/usr/bin/bzip2 -9 /backup/daftar-member-$(date +%Y%m%d).txt
/usr/bin/scp -2 -i ~/.ssh/id_dsa /backup/daftar-member-$(date +%Y%m%d).txt.bz2 harry@mydomain.com:/home/harry/backup/groups.or.id/

exit 0

A bit of background, the server uses ezmlm as the mailing list software, which is usually controlled by user “alias”.

2nd line is already interesting. Basically, we execute ls (which shows the content of directory) ~/. What is directory ~/ ? Well, the tilde character (~) is a shortcut for our home directory. So, when running this script as alias user, the “ls ~/” actually means “ls /var/qmail/alias/”
The result (list of files and directories) will then be stored in an (array) variable named “daftar_milis”

4th and 5th line sets us up for a looping. It will loop as many times as there are data in “daftar_milis”.

7th line will output a line, which is “—- MILIS: (current data in “daftar_milis”) —-“, and append ( >>) it into a file named /backup/daftar-member-(today’s date).txt

8th line runs ezmlm-list, which will list the members of the mailing list, and store in into the same file as above.

When all the data in “daftar_milis” has been processed, then the 12th line will be executed. It will compress the backup file with bzip2 compression.
Note that this compression algorithm is much more complex than standard Zip compression, therefore on a slow processor it may take a very long time to finish.

The 13th line will copy the backup file to a server somewhere on the Internet, on a secure tunnel encrypted with SSH2 protocol.

So there you are, a few examples to get you started backing up in Linux. Hope you find it useful.

A control panel for your webhosting business

A few years ago I was looking for a control panel for one of my server. This server is gonna be shared on the Internet, and many of its users are non-techies. So a control panel (like Plesk, cpanel, etc), will help them help themselves.

However, I was not able to find anything which suits me. The show stopper most of the time are either lack of an important feature, or the fact that the control panel software messes up your machine pretty good (cpanel, I’m looking at you).
Finally I understand why big webhosters tend to develop their own control panel.

So I gave it up, and administered it myself manually, with a few helper software that I cooked up myself. Still, it’s not ideal.

A few days ago I was looking at ISPconfig, because I’m interested to install it in a new server with Ubuntu 6.06 LTS. For a free control panel, I must say ISPconfig is pretty sweet.
But then I stumbled upon InterWorx-CP.

Interworx looks even better. For only about US$ 300, you get these: fantastico-like installer (user can install various web-app in one click), no-mess instalation (InterWorx is basically a bunch of php scripts), cluster-ready (sweet), and more.

If I need a commercial control panel in the future, InterWorx will be the first that gets evaluated.

Traffic shaper

I’ve been promoting Firehol to those who needs a good firewall. Firehol is actually not a firewall by itself, it’s a firewall scripting language, which is very easy to use even for newbies. Underneath, it uses Linux’s iptables to build the firewall.
I recommend Firehol to others because it’s really easy to script (and I mean it), therefore minimizing the chance for human error; but it still allows us to build a complex firewall should there’s a need to do so. And because everything is configured via a file (/etc/firehol.conf), I can easily manage firewall for servers all over the world via SSH connection.

But I still yet to find a good traffic shaper solution to accompany this. I’ve been asked by a client where I installed Firehol as part of my consulting work there, she needs a way to control bandwidth utilization of her Internet connection. So far, I couldn’t find anything suitable.
Some traffic shaper requires its own firewall, some needs dedicated server for itself, others just plain cumbersome to manage, and so on.

Luckily, today I read on firehol’s mailing list about [ CTshaper ].
It was based on Wondershaper, but has since developed extensively and no longer resembles it. What’s special about it is that CTshaper is similar to Firehol in terms of easy of use, and also it can work with our existing Firehol setup. It couldn’t be easier, just include “extras/shaper.conf” on top of Firehol’s config file, and that’s it. I like how simple this is.

Hopefully you’ll find it useful too.

Linux diagnostic software

One of the server under my supervision has started to experience problems since a few weeks ago. It has experienced several kernel Oops-es (equivalent to Windows’ BSOD I think), but sometimes it just crashed hard – no message whatsoever in the logfiles. This has me baffled for a while – I thought Fedora needed to be upgraded to the latest version at first. But then it was clear that even after updated with the latest updates, it’s still experiencing problems.

Somebody pointed out that memory should be the prime suspect at this case. So I ran memtest86, and true enough; it found hundreds of bad bits in the first 512MB.
Unfortunately, it is NOT possible to print out the error messages from memtest86, which will cause problem for me when I tried to return the memory module to the supplier. So I started to look around.
(note to self: recheck that these errors are not caused by wrong memory timing in BIOS)

Thankfully there’s memtester. I’ll give it a try probably tomorrow.

Along the way, I found several other relevant links:

[ An excellent guide on troubleshooting hardware problems on Linux ]
[ List of many diagnostic tools on Linux ]
[ Comprehensive list of tools and procedures for testing hardware on Linux ]

Hope you’ll find it useful.

phpMailman

Last year I spent about 2 weeks working on [ phpMailman ].
Unfortunately, I had to abandon it because I was assigned to other projects.

It was the most interesting projects, and potentially quite useful, that I’ve been working on. And it seems that quite a lot of others agree – I still got emails asking about it.

In short – phpMailman is a milis (mailing list) software, composed of php scripts and uses MySQL database to store its data.
It require very little to run (most webhosting package will suffice) and easy to set up. These two are things that I found lacking in other milis software.

I apologize that I’m still not able to continue my work on it. Meanwhile, I’ve updated the page with more useful information, and a link to the latest version. Hope someone will find it useful.

[ homepage of phpMailman ]

suPHP

suPHP is an Apache module which will force PHP scripts to be executed with the permission of its owner.

What does that mean ?

It means that if a script contains a vulnerability, and got exploited, then only that particular user will be affected.

This module is not supposed to be used together with mod_php, and anyway, if you’re using mod_php, any exploited PHP script will give the intruder access to everything accessible by Apache (since mod_php execute scripts as Apache’s user)

Needless to say, suPHP would be of high interest to webhosters, along with mod_security.

mod_security

mod_security is an Apache module which is designed to do things that a conventional firewall couldn’t – block application-level attacks.

While a firewall block attacks at packet level, most of them have port 80 opened to allow access to the webserver behind it. And with conventional firewall getting very good nowadays at doing its job, criminals have started to find that it can be very easy to breach your network using this route instead.

This is where mod_security come to your assistance.

It’s able to do quite a lot. For example, it’s able to filter user requests (based on your own rules), both POST and GET – protecting you from potential SQL injection, XSS, root traversal, and other attacks.
Those are already quite powerful, but there are more. It’s also makes it easy to make Apache runs chroot-ed, invoke virus scanner on uploaded files, limiting admin access based on IP address, detecting instrusions, stopping information leak – even disabling the famous FormMail from sending spam. Your creativity is pretty much the limit with it.

I can’t praise this thing enough. If you haven’t install it, I recommend you do, asap.

Further readings:
# Excellent introduction to mod_security
# chroot-ing Apache with mod_security
# ApacheSecurity.net – the website for Ivan’s (yet to be released) book, but already contains a few security tools which may be of interest to you
# HOWTO: installing mod_security on Debian stable