#!/bin/sh # # backup ab-openLDAP configuration and frontend database(s) # version 4.0 # Script by Asif Bacchus # ### text formatting presets # set colours for various log message types bold=$(tput bold) err=$(tput bold)$(tput setaf 1) info=$(tput sgr0) norm=$(tput sgr0) ok=$(tput setaf 2) # define other colours used cyan=$(tput bold)$(tput setaf 6) magenta=$(tput sgr0)$(tput setaf 5) yellow=$(tput sgr0)$(tput setaf 3) ### parameter defaults width=$(tput cols) scriptPath="$( CDPATH='' cd -- "$( dirname -- "$0" )" && pwd -P )" scriptName="$( basename "$0" )" # logfile default: same location and name as this script, with '.log' extension logfile="$scriptPath/${scriptName%.*}.log" # encryption parameters file default: same location and name as this script, # with '.params' extension encParams="$scriptPath/${scriptName%.*}.params" # backup mode by default unset removeTLS unset backupFile extract=false decrypt=false # encryption enabled by default noEncryption=0 tempDir="$(date '+%s')" fileDate="$(date '+%F_%T')" outputLocation="$scriptPath/" # frontend starts at '1', so this number should always be the number of # frontend databases + 1 -- default to only 1 frontend db numFrontEnd=2 ### functions cleanup () { logInfo 'task' 'Cleaning up' if ! docker exec "$container" rm -rf "$tempDir" \ >> "$logfile" 2>&1; then logInfo 'err' exitError 3 'Unable to remove temporary files in container.' 'nc' fi logInfo 'done' } consoleError () { printf "%s\n%s\n" "$err" "$2" printf "Exiting.\n\n%s" "$norm" exit "$1" } decryptionNote () { printf "\n" textblock "${bold}${magenta}Decrypting your backup archive:${norm}" printf "\n" textblock 'To decrypt and extract your backup file, you need the following information:' textblock '1. The password used to encrypt the file' textblock '2. The encryption cipher used (default: AES-256-CBC)' textblock '3. The number of iterations used to create the private key (default: 25000)' printf "\n" textblock "Run the following command, replacing the ${cyan}[cyan stuff in square brackets]${norm} with values appropriate to your environment." printf "\n" textblock "openssl enc -d -${cyan}[cipher-here]${norm} -iter +${cyan}[iterations]${norm} -k ${cyan}[password]${norm} -in ${cyan}[backup_archive.tar.gz]${norm} | tar -xz -C ${cyan}[destinationDirectory]${norm}" printf "\n" textblock 'NOTE: The output directory must already exist or tar will throw an error.' printf "\n" textblock "${magenta}Example:${norm}" textblock "openssl enc -d -${cyan}aes-256-cbc${norm} -iter +${cyan}25000${norm} -k ${cyan}mypassword${norm} -in ${cyan}~/ldap-2020-03-10_17:31:34.tar.gz${norm} | tar -xz -C ${cyan}~/ldapRestore${norm}" printf "\n" textblock 'Note: Using this script with the --decrypt option handles this for you and can create target directories automatically.' printf "\n\n" exit 0 } exitError () { # cleanup temp directory unless 'nc' passed if [ ! "$3" = "nc" ]; then cleanup; fi # log error printf "%s[%s] -- [ERROR] code %s: %s --%s\n" \ "$err" "$(stamp)" "$1" "$2" "$norm" >> "$logfile" printf "%s[%s] --- %s terminated with errors ---\n%s" \ "$err" "$(stamp)" "$scriptName" "$norm" >> "$logfile" # exit with proper error code exit "$1" } logInfo () { if [ "$1" = 'task' ]; then printf "%s[%s] -- [INFO] %s... " \ "$info" "$(stamp)" "$2" >> "$logfile" elif [ "$1" = 'done' ]; then if [ -z "$2" ]; then printf "%sdone%s --%s\n" \ "$ok" "$info" "$norm" >> "$logfile" else printf "%s%s%s --%s\n" \ "$ok" "$2" "$info" "$norm" >> "$logfile" fi elif [ "$1" = 'err' ]; then printf "%serror%s --%s\n" \ "$err" "$info" "$norm" >> "$logfile" else printf "%s[%s] -- [INFO] %s --%s\n" \ "$info" "$(stamp)" "$1" "$norm" >> "$logfile" fi } logSuccess () { printf "%s[%s] -- [SUCCESS] %s --%s\n" \ "$ok" "$(stamp)" "$1" "$norm" >> "$logfile" } scriptHelp () { printf "\n" textblock "${bold}${magenta}Usage: ${scriptName} [parameters]${norm}" printf "\n" textblock "${cyan}Parameters ${yellow}(default value):${norm}" textblock "There are NO mandatory parameters. By default the script will run in 'backup' mode and save an encrypted backup archive to the current directory. If a parameter is not supplied, its default value will be used. In the case of a switch parameter, it will remain deactivated if not specified." printf "\n" textblock "${bold}*** Common parameters ***${norm}" printf "\n" textblock "${cyan}-l, --log ${yellow}(scriptPath/scriptName.log)${norm}" textblock "FULL path to write log file. If you supply a path ending with a slash ('/') it will be assumed you mean a directory and the log file will be written to that directory using the format 'path/scriptname.log'. If you supply only a filename (no slashes anywhere), it will be assumed you want to save the log using that name in the script directory. The script will attempt to create any provided paths/directories if they do not exist." printf "\n" textblock "${cyan}-o, --output ${yellow}(scriptPath/)${norm}" textblock "Location where the output files should be saved on this machine. You should only specify a *directory* here (trailing slash optional). File names are automatic and cannot be changed via this script. All restore operations will create a 'restore' subdirectory in this specified directory." printf "\n" textblock "${cyan}-p, --params ${yellow}(scriptPath/scriptName.params)${norm}" textblock "Location of the encryption parameters file. This file contains the password and encryption options that should be used. By default, the script looks in the script directory for a file named the same as the script but with a '.params' extension." printf "\n" textblock "${cyan}-h, -? | -??, --help${norm}" textblock "Quick-help screen. | This (detailed) help screen." printf "\n" textblock "${bold}*** Encryption parameters ***${norm}" printf "\n" textblock "${cyan}-n, --num, --frontend ${yellow}(1)${norm}" textblock "Number of frontend databases to backup. If you specify a number here greater than actually exist, openLDAP will generate an error and your backup will fail." printf "\n" textblock "${cyan}--no-encryption${norm}" textblock "Switch parameter. Specify this if you DO NOT want the backup archive tar.gz file encrypted. Careful!" printf "\n" textblock "${bold}*** Decryption/Extraction parameters ***${norm}" printf "\n" textblock "${cyan}-b, --backupfile${norm}" textblock "FULL path of the backup file you want to decrypt/extract. MUST be supplied if using the --decrypt or --extract switches." printf "\n" textblock "${cyan}-d, --decrypt ${yellow}(implies --extract)${norm}" textblock "Switch parameter. Decrypt and extract your backup file (MUST be supplied using the --backupfile parameter) to the 'restore' subdirectory of the current directory or as specified using the '--output' parameter. This switch will log error code 8 if you try to decrypt an unencrypted backup archive." printf "\n" textblock "${cyan}-e, --extract${norm}" textblock "Switch parameter. Extract your backup file (MUST be supplied using the --backupfile parameter) to the 'restore' subdirectory of the current directory or as specified using the '--output' parameter. This switch will log error code 8 if you try to extract an encrypted backup archive. In that case, use --decrypt instead." printf "\n" textblock "${cyan}--removeTLS${norm}" textblock "Switch parameter. Remove olcTLS configuration parameters from your config DIT LDIF file. This is the only approved way to disable/change your TLS settings. Consult the openLDAP documentation or the repo wiki for more information." printf "\n" textblock "${cyan}--manualdecryption${norm}" textblock "Display instructions on how to manually decrypt and extract your backup archive." printf "\n\n" textblock "More details and examples of script usage can be found in the repo wiki at ${magenta}https://git.asifbacchus.app/ab-docker/openldap/wiki${norm}" printf "\n" } stamp () { (date +%F' '%T) } textblock () { printf "%s\n" "$1" | fold -w "$width" -s } quickHelp () { textblock "${bold}${magenta}Usage: ${scriptName} [parameters]${norm}" printf "\n" textblock "${cyan}Parameters ${yellow}(default value):${norm}" printf "\n" textblock "${bold}*** Common parameters ***${norm}" textblock "${cyan}-l, --log ${yellow}(scriptPath/scriptName.log)${norm}" textblock "FULL path to write log file. Path ending with '/' will be treated as a directory. Filename only will be saved in script directory." textblock "${cyan}-o, --output ${yellow}(scriptPath/)${norm}" textblock "Directory to save output files on this machine." textblock "${cyan}-p, --params ${yellow}(scriptPath/scriptName.params)${norm}" textblock "Location of the encryption parameters file." textblock "${cyan}-h, -? | -??, --help${norm}" textblock "This help screen. | Detailed help." printf "\n" textblock "${bold}*** Encryption parameters ***${norm}" textblock "${cyan}-n, --num, --frontend ${yellow}(1)${norm}" textblock "Number of frontend databases to backup." textblock "${cyan}--no-encryption${norm}" textblock "Switch: DO NOT encrypt backup tar.gz." printf "\n" textblock "${bold}*** Decryption/Extraction parameters ***${norm}" textblock "${cyan}-b, --backupfile${norm}" textblock "FULL path of the backup file to be decrypted/extracted." textblock "${cyan}-d, --decrypt ${yellow}(implies --extract)${norm}" textblock "Decrypt and extract specified backup file to 'restore' subdirectory of current path/specified path (--output parameter)." textblock "${cyan}-e, --extract${norm}" textblock "Extract specified backup file to 'restore' subdirectory of current path/specified path (--output parameter)." textblock "${cyan}--removeTLS${norm}" textblock "Remove all olcTLS configuration settings from your config DIT LDIF restore file." textblock "${cyan}--manualdecryption${norm}" textblock "Display instructions on manually decrypting and extracting your backup archive." printf "\n" textblock "Run script with '-?? or --help' for detailed help. More details and examples of script usage can be found in the repo wiki at:" printf "%s\thttps://git.asifbacchus.app/ab-docker/openldap/wiki%s\n\n" \ "$magenta" "$norm" } ### pre-requisite checks # is user root or in the docker group? if [ ! "$( id -u )" -eq 0 ]; then if ! id -Gn | grep docker > /dev/null; then consoleError '1' "You must either be root or in the 'docker' group to run this script since you must be able to run 'docker exec' commands against the container!" fi fi # is tar installed? if ! command -v tar > /dev/null; then consoleError '99' 'It appears that tar is not installed. This script requires tar in order to package and process backup files.' fi # is gzip installed? if ! command -v gzip > /dev/null ; then consoleError '99' 'It appears that gzip is not installed. This script requires gzip in order to compress/decompress backup tarball files.' fi # process startup parameters while [ $# -gt 0 ]; do case "$1" in -b|--backupfile) # name of backup file to decrypt/extract if [ -z "$2" ]; then consoleError '1' 'Backup file name cannot be null.' elif [ ! -f "$2" ]; then consoleError '1' "Specified backup file does not exist ($2)." fi backupFile="$2" shift ;; -d|--decrypt) # decrypt and extract backup file (implies '-e') decrypt=true extract=true ;; -e|--extract) # extract gzipped tarball extract=true ;; -h|-\?) # display brief help quickHelp exit 0 ;; -\?\?|--help) # display full help scriptHelp exit 0 ;; -l|--log) # location of log file if [ -z "$2" ]; then consoleError '1' 'Log file path cannot be null. Leave unspecified to save log in the same directory as this script.' fi logfile="$2" shift ;; --manualdecryption) decryptionNote exit 0 ;; -n|--num|--frontend) # number of frontend databases if [ -z "$2" ]; then consoleError '1' 'Number of frontend databases cannot be null.' fi numFrontEnd=$(($2+1)) shift ;; --no-encryption) # disable encryption, switch parameter noEncryption=1 # switches do not require an internal 'shift' ;; -o|--output) # directory on host to save output files if [ -z "$2" ]; then consoleError '1' 'Output destination location cannot be null.' fi outputLocation="$2" shift ;; -p|--params) # path to encryption parameters file if [ -z "$2" ]; then consoleError '1' 'Path to encryption parameters file cannot be null.' fi encParams="$2" shift ;; --removeTLS) # remove olcTLS entries from cn=config removeTLS=true ;; *) printf "%s\nUnknown option: %s\n" "$err" "$1" printf "Use '--help' for valid options.\n\n%s" "$norm" exit 1 ;; esac shift done ### start logging # logfile checks if ! printf "%s" "$logfile" | grep -o / > /dev/null; then # filename provided, save in scriptdir logfile="$scriptPath/$logfile" elif [ "$( printf "%s" "$logfile" | tail -c 1 )" = '/' ]; then # directory provided, does it exist? if [ -d "$logfile" ]; then logfile="${logfile}${scriptName%.*}.log" else if ! mkdir -p "$logfile" > /dev/null 2>&1; then consoleError '1' 'Unable to make specified log file directory.' fi logfile="${logfile}${scriptName%.*}.log" fi else # full path provided, does the parent directory exist? if [ ! -d "${logfile%/*}" ]; then # make parent path if ! mkdir -p "${logfile%/*}" > /dev/null 2>&1; then consoleError '1' 'Unable to make specified log file path.' fi fi fi # write initial log entries for script run if ! printf "%s[%s] --- Start %s execution ---%s\n" \ "$magenta" "$(stamp)" "$scriptName" "$norm" >> "$logfile"; then consoleError '1' "Unable to write to log file ($logfile)" fi logInfo "Log located at $logfile" ### process output directory if [ -d "$outputLocation" ]; then # touch test to ensure we can write here if ! touch "${outputLocation%/}/test.touch" > /dev/null 2>&1; then exitError '1' "Unable to write to output location: $outputLocation" 'nc' else logInfo "Writing output to: $outputLocation" rm -f "${outputLocation%/}/test.touch" > /dev/null 2>&1 fi else # create directory if ! mkdir -p "${outputLocation%/}" > /dev/null 2>&1; then exitError '1' "Unable to create output path: $outputLocation" 'nc' else logInfo "Writing output to: $outputLocation" fi fi ### source encryption parameters file # check if file exists (unless encryption disabled), otherwise exit if [ $noEncryption = 1 ]; then logInfo 'Backup archive will NOT be encrypted!' elif [ $noEncryption = 0 ] && [ ! -f "$encParams" ]; then exitError 1 'Encryption parameters file does not exist.' 'nc' else # import encryption parameters file case "${encParams}" in /*) # absolute path, no need to rewrite . "${encParams}" ;; *) # relative path, need to rewrite assuming current directory . "./${encParams}" ;; esac logInfo "Imported: '$encParams'" # verify import logInfo 'task' 'Verify encryption password' if [ -z "$password" ]; then logInfo 'err' exitError 1 "Imported null value for encryption 'password'." 'nc' else logInfo 'done' fi logInfo 'task' 'Verify encryption cipher' if [ -z "$encryptionCipher" ]; then logInfo 'err' exitError 1 "Imported null value for 'encryptionCipher'." 'nc' else logInfo 'done' "$encryptionCipher" fi logInfo 'task' 'Verify encryption key iterations' if [ -z "$encryptionIterations" ]; then logInfo 'err' exitError 1 "Imported null value for 'encryptionIterations'." 'nc' else logInfo 'done' "$encryptionIterations" fi fi if [ $extract = 'true' ]; then # ensure backupFile has been specifed if [ -z "$backupFile" ]; then exitError '1' 'backupFile (-b|--backupFile) must be specified when using script in Extract mode.' 'nc' fi # extract backupFile to outputLocation logInfo "Extracting backup file ($backupFile)" # create extraction target directory if [ ! -d "${outputLocation%/}/restore" ]; then # create subdirectory for restored files if ! mkdir "${outputLocation%/}/restore" > /dev/null 2>&1; then exitError '7' 'Could not create target subdirectory in output location.' 'nc' else logInfo "Extracted files will be written to '${outputLocation%/}/restore/'" fi else # ensure we can write to subdirectory for restored files if ! touch "${outputLocation%/}/restore/test.touch" > /dev/null 2>&1; then exitError '1' "Unable to write to output location: ${outputLocation%/}/restore/" 'nc' else rm -f "${outputLocation%/}/restore/test.touch" > /dev/null 2>&1 fi fi # extract/decrypt backup file if [ "$decrypt" = 'true' ]; then logInfo 'Decrypting backup file before extraction' if ! openssl enc -d -"${encryptionCipher}" -iter +"${encryptionIterations}" -k "${password}" -in "${backupFile}" 2>> "$logfile" | tar --overwrite -xz -C "${outputLocation%/}/restore/" 2>> "$logfile"; then exitError '8' 'There was a problem extracting the backup file. Perhaps the file is NOT encrypted? If so, please run with the --extract flag instead of the --decrypt flag.' 'nc' else logSuccess "Backup extracted to '${outputLocation%/}/restore/'" fi else if ! tar --overwrite -xzf "$backupFile" -C "${outputLocation%/}/restore/" 2>> "$logfile"; then exitError '8' 'There was a problem extracting the backup file. Perhaps it is encrypted? If so, please run with --decrypt flag.' 'nc' else logSuccess "Backup extracted to '${outputLocation%/}/restore/'" fi fi # remove TLS configuration if [ "$removeTLS" = 'true' ]; then # get newest config-? file in outputLocation/restore directory cnConfigFile=$( ls -Adt ${outputLocation%/}/restore/config-* | head -n1 ) # remove TLS configuration entries logInfo 'task' "Removing TLS configuration from '$cnConfigFile'" sed -i -e '/^olcTLS/d' "$cnConfigFile" 2>> "$logfile" # check our work if ! grep -q '^olcTLS' "$cnConfigFile" 2>> "$logfile"; then logInfo 'done' else logInfo 'err' exitError '20' 'olcTLS entries could not be removed from restored config DIT LDIF file. You will have to do it manually.' 'nc' fi fi elif [ $extract = 'false' ]; then ### process backup operations ## find ab-openldap container container=$(docker ps -a --no-trunc --filter "label=org.label-schema.name=ab-openldap" --format "{{ .Names }}") # check for null value -- cannot find container if [ -z "$container" ]; then exitError 2 'Cannot find ab-openldap container. Exiting.' 'nc' fi # check for multiple containers, exit if that's the case # N.B. do NOT quote $container or this loop will NOT work!!! set -- dummy $container shift containerCount=0 for c; do containerCount=$((containerCount+1)) logInfo "Found container($containerCount): $c" done if [ "$containerCount" -gt 1 ]; then exitError 2 'Multiple containers found. Exiting.' 'nc' fi ## backup databases to ldif # create temp working directory if ! docker exec "$container" mkdir "/$tempDir" >> "$logfile" 2>&1; then exitError 3 'Could not create temporary working directory.' 'nc' fi # backend to ldif logInfo 'task' 'Backup configuration database' if ! docker exec "$container" sh -c \ "slapcat -F /etc/openldap/ldif -n 0 -l ${tempDir}/config-${fileDate}.ldif" \ >> "$logfile" 2>&1; then logInfo 'err' exitError 4 'Could not backup configuration database.' fi logInfo 'done' # iterate frontend databases and export to ldif i=1 while [ "$i" -ne "$numFrontEnd" ]; do logInfo 'task' "Backup frontend database $i" if ! docker exec "$container" sh -c \ "slapcat -F /etc/openldap/ldif -n ${i} -l ${tempDir}/mdb${i}-${fileDate}.ldif" \ >> "$logfile" 2>&1; then logInfo 'err' exitError 4 "Could not backup frontend database $i." else logInfo 'done' fi i=$((i+1)) done # compress and encrypt exported ldif files if [ $noEncryption = 0 ]; then logInfo 'task' 'Compressing and encrypting backup' if ! docker exec -w "/$tempDir" "$container" sh -c \ "tar -czf - * | openssl enc -e -${encryptionCipher} -iter +${encryptionIterations} -k ${password} -out ./ldap-${fileDate}.tar.gz" \ >> "$logfile" 2>&1; then logInfo 'err' exitError 5 'Could not securely archive backup files.' fi logInfo 'done' elif [ $noEncryption = 1 ]; then logInfo 'task' 'Compressing backup' if ! docker exec -w "/$tempDir" "$container" sh -c \ "tar -czf ldap-${fileDate}.tar.gz *" \ >> "$logfile" 2>&1; then logInfo 'err' exitError 5 'Could not archive backup files.' fi logInfo 'done' fi ## copy file to output location on host logInfo 'task' 'Copying archive from docker container to host' if ! docker cp "$container:/$tempDir/ldap-${fileDate}.tar.gz" "$outputLocation/" \ >> "$logfile" 2>&1; then logInfo 'err' exitError 6 'Unable to copy backup archive from container to host.' fi logInfo 'done' logInfo "Backup file: ${outputLocation%/}/ldap-${fileDate}.tar.gz" ## cleanup and log success cleanup logSuccess 'Backup completed successfully.' fi ### exit gracefully logSuccess 'All processes completed' printf "%s[%s] --- %s execution completed ---\n%s" \ "$magenta" "$(stamp)" "$scriptName" "$norm" >> "$logfile" exit 0 # error code reference: # 0: exited normally, no errors # 1: parameter or permissions error # 2: unsupported number of containers (0 or more than 1) # 3: could not create/remove temporary directory/files # 4: problem exporting database(s) # 5: problem compressing/encrypting tar.gz archive # 6: problem copying encrypted archive to host # 7: problem creating target subdirectory in outputLocation # 8: problem extracting gzipped tarball file # 20: problem removing TLS entries # 99: dependencies not installed (tar, gzip) #EOF