bin/backup-audit

   1 #!/bin/bash
   2 #
   3 # backup-script system for cloning systems using rsync
   4 # Copyright (c)2008-2016 Alexander Barton, alex@barton.de
   5 #
   6 # This program is free software; you can redistribute it and/or modify
   7 # it under the terms of the GNU General Public License as published by
   8 # the Free Software Foundation; either version 2 of the License, or
   9 # (at your option) any later version.
  10 # Please read the file COPYING, README and AUTHORS for more information.
  11 #
  12
  13 NAME=$(basename "$0")
  14
  15 VERBOSE=0
  16 QUIET=0
  17
  18 export LC_ALL=C
  19
  20 # Default settings, can be overwritten in backup-script.conf:
  21 [ -d "/usr/local/etc/backup-script.d" ] \
  22         && conf_d="/usr/local/etc/backup-script.d" \
  23         || conf_d="/etc/backup-script.d"
  24
  25 default_backup_type="rsync"
  26 default_files="running-config"
  27 default_generations=0
  28 default_target="/var/backups"
  29
  30 # Search configuration file (last one is used as default!)
  31 for conf in \
  32         "/usr/local/etc/backup-script.conf" \
  33         "/etc/backup-script.conf" \
  34         "${conf_d}/backup-script.conf" \
  35         "/usr/local/etc/backup-script.conf" \
  36 ; do
  37         if [ -r "$conf" ]; then
  38                 # shellcheck source=/dev/null
  39                 source "$conf"
  40                 break
  41         fi
  42 done
  43
  44 Usage() {
  45         echo "Usage: $NAME [-q|--quiet] [-v|--verbose] [<system> [<system> [...]]]"
  46         echo "       $NAME <-d|--dirs> <dir1> <dir2>"
  47         echo
  48         exit 2
  49 }
  50
  51 BeginDiff() {
  52         echo "Differences in $*:"
  53 }
  54
  55 PipeDiff() {
  56         local line
  57         IFS=
  58         while read -r line; do
  59                 echo -e "     | $line"
  60         done
  61 }
  62
  63 EndDiff() {
  64         :
  65 }
  66
  67 HandleSystem() {
  68         local fname="$1"
  69
  70         # Set global defaults
  71         local backup_type="$default_backup_type"
  72         local files="$default_files"
  73         local generations="$default_generations"
  74         local local=0
  75         local system="$fname"
  76         local target="$default_target"
  77
  78         # Read in system configuration file
  79         # shellcheck source=/dev/null
  80         source "$f"
  81
  82         target="$target/$(basename "$f")"
  83
  84         [[ -d "$target" ]] || return 0
  85
  86         # System name
  87         [[ "$system" == "$fname" ]] \
  88                 && systxt="\"$system\"" \
  89                 || systxt="\"$fname\" [\"$system\"]"
  90         [[ "$local" -eq 0 ]] \
  91                 && echo "Checking $systxt ..." \
  92                 || echo "Checking $systxt (local system) ..."
  93
  94         # Check if job is disabled
  95         if [[ "$backup_type" == "disabled" ]]; then
  96                 echo "Job is DISABLED and will be skipped."
  97                 echo; return 0
  98         fi
  99
 100         if [ $generations -lt 1 ]; then
 101                 echo "No generations configured, nothing to compare, skipping system!"
 102                 echo; return 1
 103         fi
 104
 105         local latest_d="$target/latest"
 106         if [[ ! -d "$latest_d" || ! -r "$latest_d/.stamp" ]]; then
 107                 echo "Failed to access latest backup generation in \"$latest_d\", skipping system!"
 108                 echo; return 1
 109         fi
 110         echo "Found latest generation in \"$latest_d\"."
 111
 112         declare -i code=-1
 113         # shellcheck source=/dev/null
 114         source "$latest_d/.stamp"
 115
 116         if [[ $code -ne 0 && $code -ne 24 ]]; then
 117                 echo "Last backup generation has errors, skipping system!"
 118                 echo; return 1
 119         fi
 120
 121         # Search previous generation without errors
 122         local previous_d=""
 123         # shellcheck disable=SC2045
 124         for d in $(ls -1dt "$target/"[0-9]*-[0-9]* 2>/dev/null); do
 125                 [[ -d "$d" && -r "$d/.stamp" ]] || return 0
 126
 127                 declare -i code=-1
 128                 # shellcheck source=/dev/null
 129                 source "$d/.stamp"
 130
 131                 if [[ $code -eq 0 || $code -eq 24 ]]; then
 132                         previous_d="$d"
 133                         break
 134                 fi
 135         done
 136         if [[ -z "$previous_d" || ! -d "$previous_d" || ! -r "$previous_d/.stamp" ]]; then
 137                 echo "Failed to find previous successfull backup generation, skipping system!"
 138                 echo; return 1
 139         fi
 140         echo "Comparing with generation in $previous_d ..."
 141
 142         DiffGenerations "$backup_type" "$previous_d" "$latest_d" "$files"
 143         return_code=$?
 144
 145         echo
 146         return $return_code
 147 }
 148
 149 DiffGenerations() {
 150         local backup_type="$1"
 151         local gen1_d="$2"
 152         local gen2_d="$3"
 153         local files="$4"
 154
 155         local return_code=0
 156
 157         if [[ "$backup_type" == "rsync" ]]; then
 158                 # rsync Backup Type
 159
 160                 for file in \
 161                         /etc/passwd \
 162                         /etc/shadow \
 163                         /etc/group \
 164                         /etc/gshadow \
 165                         \
 166                         /boot/grub/grub.cfg \
 167                         /etc/bash.bashrc \
 168                         /etc/fstab \
 169                         /etc/hostname \
 170                         /etc/hosts \
 171                         /etc/machine-id \
 172                         /etc/modules \
 173                         /etc/network/interfaces \
 174                         /etc/networks \
 175                         /etc/nsswitch.conf \
 176                         /etc/profile \
 177                         /etc/rc.local \
 178                         /etc/resolv.conf \
 179                         /etc/services \
 180                         /etc/sudoers \
 181                         /etc/sysctl.conf \
 182                 ; do
 183                         [[ -r "${gen1_d}${file}" ]] || continue
 184
 185                         [[ $VERBOSE -ne 0 ]] && echo "Checking \"$file\" ..."
 186                         diff -U 3 "${gen1_d}${file}" "${gen2_d}${file}" >"$tmp_diff"
 187                         if [[ $? -ne 0 ]]; then
 188                                 BeginDiff "\"$file\""
 189                                 tail -n +3 "$tmp_diff" | PipeDiff
 190                                 EndDiff
 191                                 return_code=1
 192                         fi
 193                 done
 194
 195                 if [[ -d "${gen1_d}/var/lib/dpkg/info" && -d "${gen2_d}/var/lib/dpkg/info" ]]; then
 196                         [[ $VERBOSE -ne 0 ]] && echo "Checking list of installed packages ..."
 197                         chroot "${gen1_d}" dpkg --get-selections >"$tmp_1" || return 2
 198                         chroot "${gen2_d}" dpkg --get-selections >"$tmp_2" || return 2
 199                         diff -U 0 "$tmp_1" "$tmp_2" >"$tmp_diff"
 200                         if [[ $? -ne 0 ]]; then
 201                                 BeginDiff "list of installed packages"
 202                                 tail -n +3 "$tmp_diff" | grep -v '^@@ ' | PipeDiff
 203                                 EndDiff
 204                                 return_code=1
 205                         fi
 206                 fi
 207         elif [[ "$backup_type" == "scp" ]]; then
 208                 # scp Backup type
 209                 file=$(basename "$files")
 210                 [[ $VERBOSE -ne 0 ]] && echo "Checking \"$file\" ..."
 211                 diff -U 3 "${gen1_d}/${file}" "${gen2_d}/${file}" >"$tmp_diff"
 212                 if [[ $? -ne 0 ]]; then
 213                         BeginDiff "\"$file\""
 214                         tail -n +3 "$tmp_diff" | PipeDiff
 215                         EndDiff
 216                         return_code=1
 217                 fi
 218         else
 219                 echo "Backup type \"$backup_type\" undefined, \"$system\" skipped!"
 220                 echo; return 2
 221         fi
 222
 223         return $return_code
 224 }
 225
 226 MkTempFiles() {
 227         tmp_1=$(mktemp "/tmp/$NAME.XXXXXX") || exit 1
 228         tmp_2=$(mktemp "/tmp/$NAME.XXXXXX") || exit 1
 229         tmp_diff=$(mktemp "/tmp/$NAME.XXXXXX") || exit 1
 230         tmp_out=$(mktemp "/tmp/$NAME.XXXXXX") || exit 1
 231 }
 232
 233 CleanUp() {
 234         rm -f "$tmp_1" "$tmp_2" "$tmp_diff" "$tmp_out"
 235 }
 236
 237 while [[ $# -gt 0 ]]; do
 238         case "$1" in
 239           "-d"|"--dirs")
 240                 shift
 241                 [[ $# -eq 2 ]] || Usage
 242                 MkTempFiles
 243                 DiffGenerations "$default_backup_type" "$1/" "$2/" "$default_files"
 244                 return_code=$?
 245                 CleanUp
 246                 exit $return_code
 247                 ;;
 248           "-q"|"--quiet")
 249                 QUIET=1; shift
 250                 ;;
 251           "-v"|"--verbose")
 252                 VERBOSE=1; shift
 253                 ;;
 254           "-"*)
 255                 Usage
 256                 ;;
 257           *)
 258                 break
 259         esac
 260 done
 261
 262 if [[ $# -ge 1 ]]; then
 263         for s in "$@"; do
 264                 if [ ! -r "${conf_d}/$s" ]; then
 265                         echo "$NAME: Can' read \"${conf_d}/$s\"!"
 266                         exit 1
 267                 fi
 268                 sys+=("${conf_d}/$s")
 269         done
 270 else
 271         sys=("${conf_d}/"*)
 272 fi
 273
 274 MkTempFiles
 275 for f in "${sys[@]}"; do
 276         [[ -r "$f" && -f "$f" ]] || continue
 277
 278         fname=$(basename "$f")
 279         case "$fname" in
 280                 "backup-script.conf"|*.sh)
 281                         continue
 282                         ;;
 283         esac
 284
 285         HandleSystem "$fname" >"$tmp_out" 2>&1
 286         [[ $QUIET -eq 0 || $? -ne 0 ]] && cat "$tmp_out"
 287 done
 288 CleanUp
 289
 290 # -eof-