FeGM IT Wiki

Diese Seite ist nicht editierbar. Du kannst den Quelltext sehen, jedoch nicht verändern. Kontaktiere den Administrator, wenn du glaubst, dass hier ein Fehler vorliegt.
====== Raspberry Pi ======
===== NFS (Dlink DNS-320) =====
  - NAS -> Management -> Application Management -> NFS Service -> Enable...
  - NAS -> Management -> Account Management -> Network Shares -> New...
    - All Accounts
    - Read / Write
    - Map Archive
    - NFS
    - IP of Client / Write
  - check NFS from Client <code bash>rpcinfo -p $IP | grep nfs</code>
    - If this command doesn't show any output than toggle the option from step 1 a few times...
  - request NFS shares <code bash>showmount -e $IP</code>
  - mount with fstab <code bash>$IPofNAS:/mnt/HD/HD_a2/Test          /backup-nas     nfs     rw,hard,intr,nolock,noatime,noexec,rsize=8192,wsize=8192,timeo=14       0       0</code>

===== Rsnapshot Backup =====
  - add backup user <code bash>useradd backupuser -c "limited backup user" -m</code>
  - edit sudo config <code bash>visudo</code>
    - add the following lines to the file <code>#backup script
backupuser ALL=NOPASSWD: /usr/bin/rsync</code>
  - edit sshd config <code bash>vim /etc/ssh/sshd_config</code>
    - allow the backupuser access through ssh <code>AllowUsers myuser backupuser</code>
  - change permissions of sshrc.tmp file <code bash>chmod a+w /tmp/sshrc.tmp</code>
  - change user-environment to backupuser <code bash>su - backupuser</code>
  - create ssh directory <code bash>mkdir .ssh</code>
  - change permissions of ssh directory <code bash>chmod go-rwx .ssh</code>
  - authorize ssh-key of backupuser <code bash>vim .ssh/authorized_keys</code>
    - add the following line to the file <code>
command="/home/backupuser/bin/validate-backup-cmd.sh",no-port-forwarding,no-X11-forwarding,no-pty ssh-rsa [my ssh public key] [description]
</code>
  - create directory for scripts <code bash>mkdir bin</code>
  - add rsync-wrapper script <code bash>vim bin/rsync-wrapper.sh</code>
    - add the following code to the scriptfile <code>
#!/bin/sh

date >> /home/backupuser/backuplog
echo $@ >> /home/backupuser/backuplog
/usr/bin/sudo /usr/bin/rsync "$@";
</code>
  - create script to validate ssh command <code bash>vim bin/validate-backup-cmd.sh</code>
    - add the following code to the scriptfile <code>
#! /bin/bash

#$SSH_ORIGINAL_COMMAND

case "$SSH_ORIGINAL_COMMAND" in
   *\&*|*\|*|*\;*|*\>*|*\<*|*\!*)
      echo "`/bin/date`: REJECTED - $SSH_ORIGINAL_COMMAND" >> $HOME/ssh-command-log
      echo "You've tried to execute an unauthorized command!"
      exit 1
      ;;
   /home/backupuser/bin/rsync-wrapper.sh*)
   #/usr/bin/rsync\ --server\ --sender*)
      echo "`/bin/date`: $SSH_ORIGINAL_COMMAND" >> $HOME/ssh-command-log
      $SSH_ORIGINAL_COMMAND
      ;;
   *)
      echo "`/bin/date`: REJECTED - $SSH_ORIGINAL_COMMAND" >> $HOME/ssh-command-log
      echo "You've tried to execute an unauthorized command!"
      exit 1
      ;;
esac
</code>
  - give user permission to execute the script <code bash>chmod u+x bin/*.sh</code>