236 行
9.6 KiB
Bash
可执行文件
236 行
9.6 KiB
Bash
可执行文件
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
BACKUP_USER="${BACKUP_USER:-hybbackup}"
|
|
BACKUP_ROOT="${BACKUP_ROOT:-}"
|
|
PUBLIC_KEY_FILE="${PUBLIC_KEY_FILE:-}"
|
|
RECEIVER_SOURCE="${RECEIVER_SOURCE:-}"
|
|
RECEIVER_TARGET="${RECEIVER_TARGET:-/usr/local/sbin/hyb-oa-offhost-receiver}"
|
|
CONFIG_FILE="${CONFIG_FILE:-/etc/hyb-oa-offhost-backup.conf}"
|
|
ALERT_WEBHOOK_FILE="${ALERT_WEBHOOK_FILE:-}"
|
|
ALERT_HELPER_SOURCE="${ALERT_HELPER_SOURCE:-}"
|
|
ALERT_HELPER_TARGET="${ALERT_HELPER_TARGET:-/usr/local/sbin/hyb-oa-wecom-group-alert}"
|
|
DEADMAN_SOURCE="${DEADMAN_SOURCE:-}"
|
|
DEADMAN_TARGET="${DEADMAN_TARGET:-/usr/local/sbin/hyb-oa-offhost-deadman}"
|
|
DEADMAN_MAX_AGE_SECONDS="${DEADMAN_MAX_AGE_SECONDS:-93600}"
|
|
DEADMAN_RUN_AT="${DEADMAN_RUN_AT:-06:30}"
|
|
DEADMAN_SERVICE="${DEADMAN_SERVICE:-hyb-oa-offhost-deadman}"
|
|
SYSTEMD_DIR="${SYSTEMD_DIR:-/etc/systemd/system}"
|
|
DAILY_KEEP="${DAILY_KEEP:-7}"
|
|
WEEKLY_KEEP="${WEEKLY_KEEP:-4}"
|
|
MODE="${1:-install}"
|
|
|
|
fail() {
|
|
echo "[offhost-receiver-installer][ERROR] $1" >&2
|
|
exit 1
|
|
}
|
|
|
|
need_root() {
|
|
[[ "$(id -u)" == "0" ]] || fail "root privileges are required"
|
|
}
|
|
|
|
validate_absolute_path() {
|
|
local name="$1"
|
|
local value="$2"
|
|
if [[ -z "$value" || "$value" != /* || ! "$value" =~ ^/[A-Za-z0-9._/-]+$ ]]; then
|
|
fail "$name must be an explicit safe absolute path"
|
|
fi
|
|
if [[ "$value" == "/" || "$value" == */ || "$value" == *"//"* \
|
|
|| "/$value/" == *"/../"* || "/$value/" == *"/./"* ]]; then
|
|
fail "$name contains an unsafe path segment"
|
|
fi
|
|
}
|
|
|
|
validate_backup_root() {
|
|
validate_absolute_path BACKUP_ROOT "$BACKUP_ROOT"
|
|
[[ "$BACKUP_ROOT" =~ ^/[^/]+/[^/]+ ]] \
|
|
|| fail "backup root must be a dedicated path below a top-level directory"
|
|
case "$BACKUP_ROOT" in
|
|
/bin/*|/boot/*|/dev/*|/etc/*|/lib/*|/lib64/*|/proc/*|/run/*|/sbin/*|/sys/*|/usr/*)
|
|
fail "backup root must not be inside a system-managed directory"
|
|
;;
|
|
esac
|
|
[[ ! -L "$BACKUP_ROOT" ]] || fail "backup root must not be a symbolic link"
|
|
if [[ -d "$BACKUP_ROOT" ]]; then
|
|
local unmanaged_entry
|
|
unmanaged_entry="$(find "$BACKUP_ROOT" -mindepth 1 -maxdepth 1 \
|
|
! -name inbox ! -name archive ! -name weekly ! -name state -print -quit)"
|
|
[[ -z "$unmanaged_entry" ]] || fail "backup root contains an unmanaged top-level entry"
|
|
fi
|
|
}
|
|
|
|
validate_inputs() {
|
|
[[ "$BACKUP_USER" =~ ^[a-z_][a-z0-9_-]{0,30}$ ]] || fail "backup user is invalid"
|
|
validate_backup_root
|
|
validate_absolute_path PUBLIC_KEY_FILE "$PUBLIC_KEY_FILE"
|
|
validate_absolute_path RECEIVER_SOURCE "$RECEIVER_SOURCE"
|
|
validate_absolute_path RECEIVER_TARGET "$RECEIVER_TARGET"
|
|
validate_absolute_path CONFIG_FILE "$CONFIG_FILE"
|
|
validate_absolute_path ALERT_WEBHOOK_FILE "$ALERT_WEBHOOK_FILE"
|
|
validate_absolute_path ALERT_HELPER_SOURCE "$ALERT_HELPER_SOURCE"
|
|
validate_absolute_path ALERT_HELPER_TARGET "$ALERT_HELPER_TARGET"
|
|
validate_absolute_path DEADMAN_SOURCE "$DEADMAN_SOURCE"
|
|
validate_absolute_path DEADMAN_TARGET "$DEADMAN_TARGET"
|
|
[[ -f "$PUBLIC_KEY_FILE" && ! -L "$PUBLIC_KEY_FILE" ]] || fail "public key file is missing"
|
|
[[ -f "$RECEIVER_SOURCE" && ! -L "$RECEIVER_SOURCE" ]] || fail "receiver source is missing"
|
|
[[ -f "$ALERT_HELPER_SOURCE" && ! -L "$ALERT_HELPER_SOURCE" ]] || fail "alert helper source is missing"
|
|
[[ -f "$DEADMAN_SOURCE" && ! -L "$DEADMAN_SOURCE" ]] || fail "dead-man source is missing"
|
|
[[ -f "$ALERT_WEBHOOK_FILE" && ! -L "$ALERT_WEBHOOK_FILE" \
|
|
&& "$(stat -c %a "$ALERT_WEBHOOK_FILE")" == "600" \
|
|
&& "$(stat -c %u "$ALERT_WEBHOOK_FILE")" == "0" ]] \
|
|
|| fail "alert webhook file must be root-owned with mode 0600"
|
|
[[ "$DEADMAN_MAX_AGE_SECONDS" =~ ^[1-9][0-9]*$ ]] || fail "dead-man threshold must be positive"
|
|
[[ "$DEADMAN_RUN_AT" =~ ^([01][0-9]|2[0-3]):[0-5][0-9]$ ]] || fail "dead-man time is invalid"
|
|
[[ "$DEADMAN_SERVICE" =~ ^[a-z0-9][a-z0-9_-]*$ ]] || fail "dead-man service name is invalid"
|
|
[[ "$DAILY_KEEP" =~ ^[1-9][0-9]*$ && "$WEEKLY_KEEP" =~ ^[1-9][0-9]*$ ]] \
|
|
|| fail "retention values must be positive"
|
|
command -v rsync >/dev/null 2>&1 || fail "rsync must be installed before receiver setup"
|
|
command -v rrsync >/dev/null 2>&1 || fail "rrsync must be installed before receiver setup"
|
|
command -v python3 >/dev/null 2>&1 || fail "python3 is required"
|
|
}
|
|
|
|
read_public_key() {
|
|
local key_type key_body remainder extra_line_count
|
|
extra_line_count="$(awk 'NF { count += 1 } END { print count + 0 }' "$PUBLIC_KEY_FILE")"
|
|
[[ "$extra_line_count" == "1" ]] || fail "public key file must contain exactly one non-empty key"
|
|
read -r key_type key_body remainder <"$PUBLIC_KEY_FILE"
|
|
[[ "$key_type" == "ssh-ed25519" || "$key_type" == "[email protected]" ]] \
|
|
|| fail "only Ed25519 public keys are accepted"
|
|
[[ "$key_body" =~ ^[A-Za-z0-9+/=]+$ ]] || fail "public key body is invalid"
|
|
printf '%s %s' "$key_type" "$key_body"
|
|
}
|
|
|
|
install_receiver() {
|
|
need_root
|
|
validate_inputs
|
|
|
|
if ! id "$BACKUP_USER" >/dev/null 2>&1; then
|
|
useradd --create-home --shell /bin/bash "$BACKUP_USER"
|
|
fi
|
|
passwd -l "$BACKUP_USER" >/dev/null 2>&1 || true
|
|
|
|
local home_dir inbox_dir archive_dir weekly_dir state_dir ssh_dir auth_file public_key rrsync_bin
|
|
home_dir="$(getent passwd "$BACKUP_USER" | awk -F: '{print $6}')"
|
|
validate_absolute_path BACKUP_USER_HOME "$home_dir"
|
|
inbox_dir="$BACKUP_ROOT/inbox"
|
|
archive_dir="$BACKUP_ROOT/archive"
|
|
weekly_dir="$BACKUP_ROOT/weekly"
|
|
state_dir="$BACKUP_ROOT/state"
|
|
mkdir -p "$inbox_dir" "$archive_dir" "$weekly_dir" "$state_dir" "$home_dir/.ssh"
|
|
[[ -d "$BACKUP_ROOT" && ! -L "$BACKUP_ROOT" \
|
|
&& -d "$inbox_dir" && ! -L "$inbox_dir" \
|
|
&& -d "$archive_dir" && ! -L "$archive_dir" \
|
|
&& -d "$weekly_dir" && ! -L "$weekly_dir" ]] \
|
|
|| fail "backup receiver directories must not be symbolic links"
|
|
chown "$BACKUP_USER:$BACKUP_USER" "$BACKUP_ROOT"
|
|
chown -R "$BACKUP_USER:$BACKUP_USER" "$inbox_dir" "$archive_dir" "$weekly_dir" "$home_dir/.ssh"
|
|
chmod 0700 "$BACKUP_ROOT" "$inbox_dir" "$archive_dir" "$weekly_dir" "$home_dir/.ssh"
|
|
chown -R root:root "$state_dir"
|
|
chmod 0700 "$state_dir"
|
|
|
|
install -o root -g root -m 0755 "$RECEIVER_SOURCE" "$RECEIVER_TARGET"
|
|
install -o root -g root -m 0755 "$ALERT_HELPER_SOURCE" "$ALERT_HELPER_TARGET"
|
|
install -o root -g root -m 0755 "$DEADMAN_SOURCE" "$DEADMAN_TARGET"
|
|
rrsync_bin="$(command -v rrsync)"
|
|
cat >"$CONFIG_FILE" <<CONFIG
|
|
BACKUP_INBOX_DIR=${inbox_dir}
|
|
BACKUP_ARCHIVE_DIR=${archive_dir}
|
|
BACKUP_WEEKLY_DIR=${weekly_dir}
|
|
RRSYNC_BIN=${rrsync_bin}
|
|
PYTHON_BIN=python3
|
|
DAILY_KEEP=${DAILY_KEEP}
|
|
WEEKLY_KEEP=${WEEKLY_KEEP}
|
|
CONFIG
|
|
chown root:root "$CONFIG_FILE"
|
|
chmod 0644 "$CONFIG_FILE"
|
|
|
|
ssh_dir="$home_dir/.ssh"
|
|
auth_file="$ssh_dir/authorized_keys"
|
|
if [[ -s "$auth_file" ]] && ! grep -Fq 'hyb-oa-managed-offhost-backup' "$auth_file"; then
|
|
fail "dedicated backup account already has unmanaged authorized keys"
|
|
fi
|
|
public_key="$(read_public_key)"
|
|
cat >"$auth_file" <<AUTH
|
|
# hyb-oa-managed-offhost-backup
|
|
command="${RECEIVER_TARGET}",no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-pty,no-user-rc ${public_key}
|
|
AUTH
|
|
chown "$BACKUP_USER:$BACKUP_USER" "$auth_file"
|
|
chmod 0600 "$auth_file"
|
|
|
|
runuser -u "$BACKUP_USER" -- env RECEIVER_CONFIG_FILE="$CONFIG_FILE" \
|
|
"$RECEIVER_TARGET" validate-config >/dev/null
|
|
cat >"$SYSTEMD_DIR/${DEADMAN_SERVICE}.service" <<SERVICE
|
|
[Unit]
|
|
Description=hyb-oa independent off-host backup dead-man
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
UMask=0077
|
|
ExecStart=/usr/bin/python3 ${DEADMAN_TARGET} --archive-root ${archive_dir} --state-dir ${state_dir} --webhook-file ${ALERT_WEBHOOK_FILE} --alert-helper ${ALERT_HELPER_TARGET} --max-age-seconds ${DEADMAN_MAX_AGE_SECONDS}
|
|
SERVICE
|
|
cat >"$SYSTEMD_DIR/${DEADMAN_SERVICE}.timer" <<TIMER
|
|
[Unit]
|
|
Description=Check hyb-oa off-host backup freshness independently
|
|
|
|
[Timer]
|
|
OnCalendar=*-*-* ${DEADMAN_RUN_AT}:00
|
|
Persistent=true
|
|
Unit=${DEADMAN_SERVICE}.service
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
TIMER
|
|
systemctl daemon-reload
|
|
echo "[offhost-receiver-installer][PASS] restricted receiver and disabled dead-man installed"
|
|
}
|
|
|
|
enable_receiver() {
|
|
install_receiver
|
|
systemctl enable --now "${DEADMAN_SERVICE}.timer"
|
|
echo "[offhost-receiver-installer][PASS] dead-man timer enabled"
|
|
}
|
|
|
|
uninstall_receiver() {
|
|
need_root
|
|
[[ "$BACKUP_USER" =~ ^[a-z_][a-z0-9_-]{0,30}$ ]] || fail "backup user is invalid"
|
|
validate_absolute_path RECEIVER_TARGET "$RECEIVER_TARGET"
|
|
validate_absolute_path CONFIG_FILE "$CONFIG_FILE"
|
|
validate_absolute_path ALERT_HELPER_TARGET "$ALERT_HELPER_TARGET"
|
|
validate_absolute_path DEADMAN_TARGET "$DEADMAN_TARGET"
|
|
[[ "$DEADMAN_SERVICE" =~ ^[a-z0-9][a-z0-9_-]*$ ]] || fail "dead-man service name is invalid"
|
|
systemctl disable --now "${DEADMAN_SERVICE}.timer" >/dev/null 2>&1 || true
|
|
systemctl stop "${DEADMAN_SERVICE}.service" >/dev/null 2>&1 || true
|
|
rm -f -- "$SYSTEMD_DIR/${DEADMAN_SERVICE}.timer" "$SYSTEMD_DIR/${DEADMAN_SERVICE}.service"
|
|
if id "$BACKUP_USER" >/dev/null 2>&1; then
|
|
local home_dir auth_file
|
|
home_dir="$(getent passwd "$BACKUP_USER" | awk -F: '{print $6}')"
|
|
auth_file="$home_dir/.ssh/authorized_keys"
|
|
if [[ -f "$auth_file" ]] && grep -Fq 'hyb-oa-managed-offhost-backup' "$auth_file"; then
|
|
rm -f -- "$auth_file"
|
|
fi
|
|
fi
|
|
rm -f -- "$RECEIVER_TARGET" "$CONFIG_FILE" "$ALERT_HELPER_TARGET" "$DEADMAN_TARGET"
|
|
systemctl daemon-reload
|
|
echo "[offhost-receiver-installer][PASS] receiver authorization and dead-man removed; archives retained"
|
|
}
|
|
|
|
case "$MODE" in
|
|
install)
|
|
install_receiver
|
|
;;
|
|
enable)
|
|
enable_receiver
|
|
;;
|
|
uninstall|--uninstall)
|
|
uninstall_receiver
|
|
;;
|
|
--help|-h)
|
|
echo "Usage: <explicit backup/key/helper/dead-man/webhook paths> bash install-offhost-backup-receiver.sh [install|enable|uninstall]"
|
|
;;
|
|
*)
|
|
fail "unsupported mode"
|
|
;;
|
|
esac
|