MOD_REWRITE OVERVIEW
http://www.sitepoint.com/article/guide-url-rewriting
http://www.jeffdarlington.com/tag/mod_rewrite/
LINUX SECURE CONFIG
http://aymanh.com/tips-to-secure-linux-workstation
PHP SECURE CONFIG
http://aymanh.com/checklist-for-securing-php-configuration
MOD_REWRITE SCRIPTS FOR APACHE
SIMPLEST SET OF RULES
==================================================================
#Turn on mod_rewrite
RewriteEngine On
RewriteOptions inherit
RewriteLog "/var/log/httpd/rewrite_log"
# Prevent harmful binary execution through injection
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)chmod(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)chown(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)wget(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)cmd(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)cd%20(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)scp(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)curl(.*) [OR]
# Disable TRACE & TRACK methods
RewriteCond %{REQUEST_METHOD} TRACE [OR]
RewriteCond %{REQUEST_METHOD} TRACK [OR]
# Redirect objectional persons to the bit bucket
RewriteRule ^.* - [F,L]
#Turn on mod_rewrite
RewriteEngine On
RewriteOptions inherit
RewriteLog w3g_rewrite_log
#Disable command line hacks via XSS scripting w/ vulnerable PHP options & includes
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)chmod(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)chown(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)wget(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)cmd(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)cd%20(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)scp(.*) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)curl(.*) [OR]
#Disable TRACE & TRACK methods
RewriteCond %{REQUEST_METHOD} TRACE [OR]
RewriteCond %{REQUEST_METHOD} TRACK [OR]
#Other hack prevention, mostly windows-based
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)/winnt/system32/(.*) [NC,OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)/winnt/system/(.*) [NC,OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)/windows/system32/(.*) [NC,OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)/windows/system/(.*) [NC,OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)/cmd\.exe[$|\?(.*)] [NC,OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)/scripts/root.exe[$|\?(.*)] [NC,OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)/msadc/root\.exe[$|\?(.*)] [NC,OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)\\\.\.(.*) [NC,OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)/admin\.dll[$|\?(.*)] [NC,OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)/msadcs\.dll[$|\?(.*)] [NC,OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)/ext\.dll[$|\?(.*)] [NC,OR]
RewriteCond %{REQUEST_URI} (.*)/\.(.*) [NC,OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)/php\.exe[$|\?(.*)] [NC,OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} (.*)\|(.*) [OR]
RewriteCond %{REQUEST_URI} (.{255,}) [OR]
RewriteCond %{QUERY_STRING} (.{127,}) [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} [\x00-\x1f]+ [OR]
RewriteCond %{REQUEST_URI}?%{QUERY_STRING} [\x7f|\xff]+
#Rewrite offending persons to forbidden page
RewriteRule (.*) [F]
# Stop bad bots/spiders
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^BlackWidow [OR]
RewriteCond %{HTTP_USER_AGENT} ^Bot\ mailto:craftbot@yahoo.com [OR]
RewriteCond %{HTTP_USER_AGENT} ^ChinaClaw [OR]
RewriteCond %{HTTP_USER_AGENT} ^Custo [OR]
RewriteCond %{HTTP_USER_AGENT} ^DISCo [OR]
RewriteCond %{HTTP_USER_AGENT} ^Download\ Demon [OR]
RewriteCond %{HTTP_USER_AGENT} ^eCatch [OR]
RewriteCond %{HTTP_USER_AGENT} ^EirGrabber [OR]
RewriteCond %{HTTP_USER_AGENT} ^EmailSiphon [OR]
RewriteCond %{HTTP_USER_AGENT} ^EmailWolf [OR]
RewriteCond %{HTTP_USER_AGENT} ^Express\ WebPictures [OR]
RewriteCond %{HTTP_USER_AGENT} ^ExtractorPro [OR]
RewriteCond %{HTTP_USER_AGENT} ^EyeNetIE [OR]
RewriteCond %{HTTP_USER_AGENT} ^FlashGet [OR]
RewriteCond %{HTTP_USER_AGENT} ^GetRight [OR]
RewriteCond %{HTTP_USER_AGENT} ^GetWeb! [OR]
RewriteCond %{HTTP_USER_AGENT} ^Go!Zilla [OR]
RewriteCond %{HTTP_USER_AGENT} ^Go-Ahead-Got-It [OR]
RewriteCond %{HTTP_USER_AGENT} ^GrabNet [OR]
RewriteCond %{HTTP_USER_AGENT} ^Grafula [OR]
RewriteCond %{HTTP_USER_AGENT} ^HMView [OR]
RewriteCond %{HTTP_USER_AGENT} HTTrack [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^Image\ Stripper [OR]
RewriteCond %{HTTP_USER_AGENT} ^Image\ Sucker [OR]
RewriteCond %{HTTP_USER_AGENT} Indy\ Library [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^InterGET [OR]
RewriteCond %{HTTP_USER_AGENT} ^Internet\ Ninja [OR]
RewriteCond %{HTTP_USER_AGENT} ^JetCar [OR]
RewriteCond %{HTTP_USER_AGENT} ^JOC\ Web\ Spider [OR]
RewriteCond %{HTTP_USER_AGENT} ^larbin [OR]
RewriteCond %{HTTP_USER_AGENT} ^LeechFTP [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mass\ Downloader [OR]
RewriteCond %{HTTP_USER_AGENT} ^MIDown\ tool [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mister\ PiX [OR]
RewriteCond %{HTTP_USER_AGENT} ^Navroad [OR]
RewriteCond %{HTTP_USER_AGENT} ^NearSite [OR]
RewriteCond %{HTTP_USER_AGENT} ^NetAnts [OR]
RewriteCond %{HTTP_USER_AGENT} ^NetSpider [OR]
RewriteCond %{HTTP_USER_AGENT} ^Net\ Vampire [OR]
RewriteCond %{HTTP_USER_AGENT} ^NetZIP [OR]
RewriteCond %{HTTP_USER_AGENT} ^Octopus [OR]
RewriteCond %{HTTP_USER_AGENT} ^Offline\ Explorer [OR]
RewriteCond %{HTTP_USER_AGENT} ^Offline\ Navigator [OR]
RewriteCond %{HTTP_USER_AGENT} ^PageGrabber [OR]
RewriteCond %{HTTP_USER_AGENT} ^Papa\ Foto [OR]
RewriteCond %{HTTP_USER_AGENT} ^pavuk [OR]
RewriteCond %{HTTP_USER_AGENT} ^pcBrowser [OR]
RewriteCond %{HTTP_USER_AGENT} ^RealDownload [OR]
RewriteCond %{HTTP_USER_AGENT} ^ReGet [OR]
RewriteCond %{HTTP_USER_AGENT} ^SiteSnagger [OR]
RewriteCond %{HTTP_USER_AGENT} ^SmartDownload [OR]
RewriteCond %{HTTP_USER_AGENT} ^SuperBot [OR]
RewriteCond %{HTTP_USER_AGENT} ^SuperHTTP [OR]
RewriteCond %{HTTP_USER_AGENT} ^Surfbot [OR]
RewriteCond %{HTTP_USER_AGENT} ^tAkeOut [OR]
RewriteCond %{HTTP_USER_AGENT} ^Teleport\ Pro [OR]
RewriteCond %{HTTP_USER_AGENT} ^VoidEYE [OR]
RewriteCond %{HTTP_USER_AGENT} ^Web\ Image\ Collector [OR]
RewriteCond %{HTTP_USER_AGENT} ^Web\ Sucker [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebAuto [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebCopier [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebFetch [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebGo\ IS [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebLeacher [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebReaper [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebSauger [OR]
RewriteCond %{HTTP_USER_AGENT} ^Website\ eXtractor [OR]
RewriteCond %{HTTP_USER_AGENT} ^Website\ Quester [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebStripper [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebWhacker [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebZIP [OR]
RewriteCond %{HTTP_USER_AGENT} ^Wget [OR]
RewriteCond %{HTTP_USER_AGENT} ^Widow [OR]
RewriteCond %{HTTP_USER_AGENT} ^WWWOFFLE [OR]
RewriteCond %{HTTP_USER_AGENT} ^Xaldon\ WebSpider [OR]
RewriteCond %{HTTP_USER_AGENT} ^Zeus
RewriteRule ^.* - [F,L]
Wednesday, July 29, 2009
Tuesday, July 28, 2009
Changing hostname in Linux
Change hostname linux
If your change is only temporary, or you want to make it without rebooting, you just need to use the hostname command, which can be found at /bin/hostname. Running it without arguments just outputs the current hostname. To change it, su to root and run hostname newhostname.
You need to look at the value for hostname in /etc/sysconfig/network
The contents will look something like this:
NETWORKING=yes
HOSTNAME=oldname
GATEWAY=10.10.1.1
Change the HOSTNAME= parameter value to the proper hostname
NETWORKING=yes
HOSTNAME=fancynewname
GATEWAY=10.10.1.1
...and save the file
Make sure that /etc/hosts has the new hostname properly referenced in it
Then restart the network service (this will not take the box down)
service network restart
If that doesn't do it, you can modify /proc/sys/kernel/hostname to modify it on the fly.
If that doesn't do it, reboot the machine after making those changes and it should come back up with the new hostname.
If your change is only temporary, or you want to make it without rebooting, you just need to use the hostname command, which can be found at /bin/hostname. Running it without arguments just outputs the current hostname. To change it, su to root and run hostname newhostname.
You need to look at the value for hostname in /etc/sysconfig/network
The contents will look something like this:
NETWORKING=yes
HOSTNAME=oldname
GATEWAY=10.10.1.1
Change the HOSTNAME= parameter value to the proper hostname
NETWORKING=yes
HOSTNAME=fancynewname
GATEWAY=10.10.1.1
...and save the file
Make sure that /etc/hosts has the new hostname properly referenced in it
Then restart the network service (this will not take the box down)
service network restart
If that doesn't do it, you can modify /proc/sys/kernel/hostname to modify it on the fly.
If that doesn't do it, reboot the machine after making those changes and it should come back up with the new hostname.
Linux SMTP Test Script
Must telnet to port 25 of the mail server first
---------------------------------------------------
ehlo test
mail from:
rcpt to:
data
subject: test via telnet
test via telnet to jim b - should create a log entry
.
---------------------------------------------------
ehlo test
mail from:
rcpt to:
data
subject: test via telnet
test via telnet to jim b - should create a log entry
.
Creating Client SSL VPN on Cisco ASAs
Introduction
This document how to allow remote access VPN connections to the ASA from the Cisco AnyConnect 2.0 client.
Prerequisites
Requirements
Ensure that you meet these requirements before you attempt this configuration:
*
Basic ASA configuration that runs software version 8.0
*
ASDM 6.0(2)
Components Used
The information in this document is based on these software and hardware versions:
* Cisco ASA 8.0(2), ASDM 6.0 (2)
* Cisco AnyConnect 2.0
Background Information
The Cisco AnyConnect 2.0 client is an SSL-based VPN client. The AnyConnect client can be utilized and installed on a variety of operating systems, such as Windows 2000, XP, Vista, Linux (Multiple Distros) and MAC OS X. The AnyConnect client can be installed manually on the remote PC by the system administrator. It can also be loaded onto the security appliance and made ready for download to remote users. After the application is downloaded, it can automatically uninstall itself after the connection terminates, or it can remain on the remote PC for future SSL VPN connections. This example makes the AnyConnect client ready to download upon successful browser-based SSL authentication.
For more information on the AnyConnect 2.0 client, refer to AnyConnect 2.0 Release Notes.
Note: MS Terminal Services is not supported in conjunction with the AnyConnect client. You cannot RDP to a computer and then initiate an AnyConnect session. You cannot RDP to a client that is connected via AnyConnect.
Note: The first installation of AnyConnect requires the user to have admin rights (whether you use the standalone AnyConnect msi package or push the pkg file from the ASA). If the user does not have admin rights, a dialog box appears that states this requirement. Subsequent upgrades will not require the user that installed AnyConnect previously to have admin rights.
Configure
Step 1. Configure a Self-Issued Certificate
By default, the security appliance has a self-signed certificate that is regenerated every time the device is rebooted. You can purchase your own certificate from vendors, such as Verisign or EnTrust, or you can configure the ASA to issue an identity certificate to itself. This certificate remains the same even when the device is rebooted. Complete this step in order to generate a self-issued certificate that persists when the device is rebooted.
ASDM Procedure
1.
Click Configuration, and then click Remote Access VPN.
2.
Expand Certificate Management, and then choose Identity Certificates.
3.
Click Add, and then click the Add a new identity certificate radio button.
4.
Click New.
5.
In the Add Key Pair dialog box, click the Enter new key pair name radio button.
6.
Enter a name to identify the keypair.
This example uses sslvpnkeypair.
7.
Click Generate Now.
8.
In the Add Identity Certificate dialog box, ensure the newly created key pair is selected.
9.
For Certificate Subject DN, enter the fully qualified domain name (FQDN) that will be used to connect to the VPN terminating interface.
CN=sslvpn.cisco.com
10.
Click Advanced, and enter the FQDN used for the Certificate Subject DN field.
For example, FQDN: sslvpn.cisco.com
11.
Click OK.
12.
Check the Generate Self Signed Certificate check box, and click Add Certificate.
13.
Click OK.
14.
Click Configuration, and then click Remote Access VPN.
15.
Expand Advanced, and choose SSL Settings.
16.
In the Certificates area, choose the interface that will be used to terminate the SSL VPN (outside), and click Edit.
17.
In the Certificate drop-down list, choose the self-signed certificate that you generated earlier.
18.
Click OK, and then click Apply.
Step 2. Upload and Identify the SSL VPN Client Image
This document uses the AnyConnect SSL 2.0 client. You can obtain this client at the Cisco Software Download Website. A separate Anyconnect image is required for each operating system that remote users plan to use. For more information, refer to Cisco AnyConnect 2.0 Release Notes.
Once you obtain the AnyConnect client, complete these steps:
ASDM Procedure
1.
Click Configuration, and then click Remote Access VPN.
2.
Expand Network (Client) Access, and then expand Advanced.
3.
Expand SSL VPN, and choose Client Settings.
4.
In the SSL VPN Client Images area, click Add, and then click Upload.
5.
Browse to the location where you downloaded the AnyConnect client.
6.
Select the file, and click Upload File.
Once the client uploads, you receive a message that states the file was uploaded to flash successully.
7.
Click OK.
A dialog box appears to confirm that you want to use the newly uploaded image as the current SSL VPN client image.
8.
Click OK.
9.
Click OK, and then click Apply.
10.
Repeat the steps in this section for each operating system-specific Anyconnect package that you want to use.
Step 3. Enable Anyconnect Access
In order to allow the AnyConnect client to connect to the ASA, you must enable access on the interface that terminates SSL VPN connections. This example uses the outside interface in order to terminate Anyconnect connections.
ASDM Procedure
1.
Click Configuration, and then click Remote Access VPN.
2.
Expand Network (Client) Access, and then choose SSL VPN Connection Profiles.
3.
Check the Enable Cisco AnyConnect VPN Client check box.
4.
Check the Allow Access check box for the outside interface, and click Apply.
Step 4. Create a new Group Policy
A group policy specifies the configuration parameters that should be applied to clients when they connect. This example creates a group policy named SSLClientPolicy.
ASDM Procedure
1.
Click Configuration, and then click Remote Access VPN.
2.
Expand Network (Client) Access, and choose Group Policies.
3.
Click Add.
4.
Choose General, and enter SSLClientPolicy in the Name field.
5.
Uncheck the Address Pools Inherit check box.
6.
Click Select, and then click Add.
The Add IP Pool dialog box appears.
7.
Configure the address pool from an IP range that is not currently in use on your network.
This example uses these values:
*
Name: SSLClientPool
*
Starting IP Address: 192.168.25.1
*
Ending IP Address: 192.168.25.50
*
Subnet Mask: 255.255.255.0
8.
Click OK.
9.
Choose the newly created pool, and click Assign.
10.
Click OK, and then click More Options.
11.
Uncheck the Tunneling Protocols Inherit check box.
12.
Check SSL VPN Client.
13.
In the left pane, choose Servers.
14.
Uncheck the DNS Servers Inherit check box, and enter the IP address of the internal DNS server that the AnyConnect clients will use.
This example uses 192.168.50.5.
15.
Click More Options.
16.
Uncheck the Default Domain Inherit check box.
17.
Enter the domain used by your internal network. For example, tsweb.local .
18.
Click OK, and then click Apply.
Configure Access List Bypass for VPN Connections
When you enable this option, you allow the SSL/IPsec clients to bypass the interface access list.
ASDM Procedure
1.
Click Configuration, and then click Remote Access VPN.
2.
Expand Network (Client) Access, and then expand Advanced.
3.
Expand SSL VPN, and choose Bypass Interface Access List.
4.
Ensure the Enable inbound SSL VPN and IPSEC Sessions to bypass interface access lists check box is checked, and click Apply.
Step 6. Create a Connection Profile and Tunnel Group for the AnyConnect Client Connections
When VPN clients connect to the ASA, they connect to a connection profile or tunnel group. The tunnel group is used to define connection parameters for specific types of VPN connections, such as IPsec L2L, IPsec remote access, clientless SSL, and client SSL.
ASDM Procedure
1.
Click Configuration, and then click Remote Access VPN.
2.
Expand Network (Client) Access, and then expand SSL VPN.
3.
Choose Connection Profiles, and click Add.
4.
Choose Basic, and enter these values:
*
Name: SSLClientProfile
*
Authentication: LOCAL
*
Default Group Policy: SSLClientPolicy
5.
Ensure the SSL VPN Client Protocol check box is checked.
6.
In the left pane, expand Advanced, and choose SSL VPN.
7.
Under Connection Aliases, click Add, and enter a name to which users can associate their VPN connections. For example, SSLVPNClient.
8.
Click OK, and then click OK again.
9.
At the bottom of the ASDM window, check the Allow user to select connection, identified by alias in the table above at login page check box, and click Apply.
Step 7. Configure NAT Exemption for AnyConnect Clients
NAT exemption should be configured for any IP addresses or ranges you want to allow the SSL VPN clients to access. In this example, the SSL VPN clients need access to the internal IP 192.168.50.5 only.
Note: If NAT-control is not enabled, this step is not required. Use the show run nat-control command to verify. In order to verify through ASDM, click Configuration, click Firewall, and choose Nat Rules. If the Enable traffic through the firewall without address translation check box is checked, you can skip this step.
ASDM Procedure
1.
Click Configuration, and then click Firewall.
2.
Choose Nat Rules, and click Add.
3.
Choose Add NAT Exempt Rule, and enter these values:
*
Action: Exempt
*
Interface: inside
*
Source: 192.168.50.5
*
Destination: 192.168.25.0/24
*
NAT Exempt Direction: NAT Exempt outbound traffic from interface 'inside' to lower security interfaces (Default)
4.
Click OK, and then click Apply.
Step 8. Add Users to the Local Database
If you use local authentication (the default), you must define user names and passwords in the local database for user authentication.
ASDM Procedure
1.
Click Configuration, and then click Remote Access VPN.
2.
Expand AAA Setup, and choose Local Users.
3.
Click Add, and enter these values:
*
Username: matthewp
*
Password: p@ssw0rd
*
Confirm Password: p@ssw0rd
4.
Select the No ASDM, SSH, Telnet or Console Access radio button.
5.
Click OK, and then click Apply.
6.
Repeat this step for additional users, and then click Save.
Verify SSL VPN Client Connections
Use the show vpn-sessiondb svc command in order to verify connected SSL VPN clients.
ciscoasa(config-group-policy)#show vpn-sessiondb svc
Session Type: SVC
Username : matthewp Index : 6
Assigned IP : 192.168.25.1 Public IP : 172.18.12.111
Protocol : Clientless SSL-Tunnel DTLS-Tunnel
Encryption : RC4 AES128 Hashing : SHA1
Bytes Tx : 35466 Bytes Rx : 27543
Group Policy : SSLClientPolicy Tunnel Group : SSLClientProfile
Login Time : 20:06:59 UTC Tue Oct 16 2007
Duration : 0h:00m:12s
NAC Result : Unknown
VLAN Mapping : N/A VLAN : none
ciscoasa(config-group-policy)#
The vpn-sessiondb logoff name username command logs off users by user name. An Administrator Reset message is sent to the user when disconnected.
ciscoasa(config)#vpn-sessiondb logoff name matthewp
Do you want to logoff the VPN session(s)? [confirm]
INFO: Number of sessions with name "matthewp" logged off : 1
ciscoasa(config)#
This document how to allow remote access VPN connections to the ASA from the Cisco AnyConnect 2.0 client.
Prerequisites
Requirements
Ensure that you meet these requirements before you attempt this configuration:
*
Basic ASA configuration that runs software version 8.0
*
ASDM 6.0(2)
Components Used
The information in this document is based on these software and hardware versions:
* Cisco ASA 8.0(2), ASDM 6.0 (2)
* Cisco AnyConnect 2.0
Background Information
The Cisco AnyConnect 2.0 client is an SSL-based VPN client. The AnyConnect client can be utilized and installed on a variety of operating systems, such as Windows 2000, XP, Vista, Linux (Multiple Distros) and MAC OS X. The AnyConnect client can be installed manually on the remote PC by the system administrator. It can also be loaded onto the security appliance and made ready for download to remote users. After the application is downloaded, it can automatically uninstall itself after the connection terminates, or it can remain on the remote PC for future SSL VPN connections. This example makes the AnyConnect client ready to download upon successful browser-based SSL authentication.
For more information on the AnyConnect 2.0 client, refer to AnyConnect 2.0 Release Notes.
Note: MS Terminal Services is not supported in conjunction with the AnyConnect client. You cannot RDP to a computer and then initiate an AnyConnect session. You cannot RDP to a client that is connected via AnyConnect.
Note: The first installation of AnyConnect requires the user to have admin rights (whether you use the standalone AnyConnect msi package or push the pkg file from the ASA). If the user does not have admin rights, a dialog box appears that states this requirement. Subsequent upgrades will not require the user that installed AnyConnect previously to have admin rights.
Configure
Step 1. Configure a Self-Issued Certificate
By default, the security appliance has a self-signed certificate that is regenerated every time the device is rebooted. You can purchase your own certificate from vendors, such as Verisign or EnTrust, or you can configure the ASA to issue an identity certificate to itself. This certificate remains the same even when the device is rebooted. Complete this step in order to generate a self-issued certificate that persists when the device is rebooted.
ASDM Procedure
1.
Click Configuration, and then click Remote Access VPN.
2.
Expand Certificate Management, and then choose Identity Certificates.
3.
Click Add, and then click the Add a new identity certificate radio button.
4.
Click New.
5.
In the Add Key Pair dialog box, click the Enter new key pair name radio button.
6.
Enter a name to identify the keypair.
This example uses sslvpnkeypair.
7.
Click Generate Now.
8.
In the Add Identity Certificate dialog box, ensure the newly created key pair is selected.
9.
For Certificate Subject DN, enter the fully qualified domain name (FQDN) that will be used to connect to the VPN terminating interface.
CN=sslvpn.cisco.com
10.
Click Advanced, and enter the FQDN used for the Certificate Subject DN field.
For example, FQDN: sslvpn.cisco.com
11.
Click OK.
12.
Check the Generate Self Signed Certificate check box, and click Add Certificate.
13.
Click OK.
14.
Click Configuration, and then click Remote Access VPN.
15.
Expand Advanced, and choose SSL Settings.
16.
In the Certificates area, choose the interface that will be used to terminate the SSL VPN (outside), and click Edit.
17.
In the Certificate drop-down list, choose the self-signed certificate that you generated earlier.
18.
Click OK, and then click Apply.
Step 2. Upload and Identify the SSL VPN Client Image
This document uses the AnyConnect SSL 2.0 client. You can obtain this client at the Cisco Software Download Website. A separate Anyconnect image is required for each operating system that remote users plan to use. For more information, refer to Cisco AnyConnect 2.0 Release Notes.
Once you obtain the AnyConnect client, complete these steps:
ASDM Procedure
1.
Click Configuration, and then click Remote Access VPN.
2.
Expand Network (Client) Access, and then expand Advanced.
3.
Expand SSL VPN, and choose Client Settings.
4.
In the SSL VPN Client Images area, click Add, and then click Upload.
5.
Browse to the location where you downloaded the AnyConnect client.
6.
Select the file, and click Upload File.
Once the client uploads, you receive a message that states the file was uploaded to flash successully.
7.
Click OK.
A dialog box appears to confirm that you want to use the newly uploaded image as the current SSL VPN client image.
8.
Click OK.
9.
Click OK, and then click Apply.
10.
Repeat the steps in this section for each operating system-specific Anyconnect package that you want to use.
Step 3. Enable Anyconnect Access
In order to allow the AnyConnect client to connect to the ASA, you must enable access on the interface that terminates SSL VPN connections. This example uses the outside interface in order to terminate Anyconnect connections.
ASDM Procedure
1.
Click Configuration, and then click Remote Access VPN.
2.
Expand Network (Client) Access, and then choose SSL VPN Connection Profiles.
3.
Check the Enable Cisco AnyConnect VPN Client check box.
4.
Check the Allow Access check box for the outside interface, and click Apply.
Step 4. Create a new Group Policy
A group policy specifies the configuration parameters that should be applied to clients when they connect. This example creates a group policy named SSLClientPolicy.
ASDM Procedure
1.
Click Configuration, and then click Remote Access VPN.
2.
Expand Network (Client) Access, and choose Group Policies.
3.
Click Add.
4.
Choose General, and enter SSLClientPolicy in the Name field.
5.
Uncheck the Address Pools Inherit check box.
6.
Click Select, and then click Add.
The Add IP Pool dialog box appears.
7.
Configure the address pool from an IP range that is not currently in use on your network.
This example uses these values:
*
Name: SSLClientPool
*
Starting IP Address: 192.168.25.1
*
Ending IP Address: 192.168.25.50
*
Subnet Mask: 255.255.255.0
8.
Click OK.
9.
Choose the newly created pool, and click Assign.
10.
Click OK, and then click More Options.
11.
Uncheck the Tunneling Protocols Inherit check box.
12.
Check SSL VPN Client.
13.
In the left pane, choose Servers.
14.
Uncheck the DNS Servers Inherit check box, and enter the IP address of the internal DNS server that the AnyConnect clients will use.
This example uses 192.168.50.5.
15.
Click More Options.
16.
Uncheck the Default Domain Inherit check box.
17.
Enter the domain used by your internal network. For example, tsweb.local .
18.
Click OK, and then click Apply.
Configure Access List Bypass for VPN Connections
When you enable this option, you allow the SSL/IPsec clients to bypass the interface access list.
ASDM Procedure
1.
Click Configuration, and then click Remote Access VPN.
2.
Expand Network (Client) Access, and then expand Advanced.
3.
Expand SSL VPN, and choose Bypass Interface Access List.
4.
Ensure the Enable inbound SSL VPN and IPSEC Sessions to bypass interface access lists check box is checked, and click Apply.
Step 6. Create a Connection Profile and Tunnel Group for the AnyConnect Client Connections
When VPN clients connect to the ASA, they connect to a connection profile or tunnel group. The tunnel group is used to define connection parameters for specific types of VPN connections, such as IPsec L2L, IPsec remote access, clientless SSL, and client SSL.
ASDM Procedure
1.
Click Configuration, and then click Remote Access VPN.
2.
Expand Network (Client) Access, and then expand SSL VPN.
3.
Choose Connection Profiles, and click Add.
4.
Choose Basic, and enter these values:
*
Name: SSLClientProfile
*
Authentication: LOCAL
*
Default Group Policy: SSLClientPolicy
5.
Ensure the SSL VPN Client Protocol check box is checked.
6.
In the left pane, expand Advanced, and choose SSL VPN.
7.
Under Connection Aliases, click Add, and enter a name to which users can associate their VPN connections. For example, SSLVPNClient.
8.
Click OK, and then click OK again.
9.
At the bottom of the ASDM window, check the Allow user to select connection, identified by alias in the table above at login page check box, and click Apply.
Step 7. Configure NAT Exemption for AnyConnect Clients
NAT exemption should be configured for any IP addresses or ranges you want to allow the SSL VPN clients to access. In this example, the SSL VPN clients need access to the internal IP 192.168.50.5 only.
Note: If NAT-control is not enabled, this step is not required. Use the show run nat-control command to verify. In order to verify through ASDM, click Configuration, click Firewall, and choose Nat Rules. If the Enable traffic through the firewall without address translation check box is checked, you can skip this step.
ASDM Procedure
1.
Click Configuration, and then click Firewall.
2.
Choose Nat Rules, and click Add.
3.
Choose Add NAT Exempt Rule, and enter these values:
*
Action: Exempt
*
Interface: inside
*
Source: 192.168.50.5
*
Destination: 192.168.25.0/24
*
NAT Exempt Direction: NAT Exempt outbound traffic from interface 'inside' to lower security interfaces (Default)
4.
Click OK, and then click Apply.
Step 8. Add Users to the Local Database
If you use local authentication (the default), you must define user names and passwords in the local database for user authentication.
ASDM Procedure
1.
Click Configuration, and then click Remote Access VPN.
2.
Expand AAA Setup, and choose Local Users.
3.
Click Add, and enter these values:
*
Username: matthewp
*
Password: p@ssw0rd
*
Confirm Password: p@ssw0rd
4.
Select the No ASDM, SSH, Telnet or Console Access radio button.
5.
Click OK, and then click Apply.
6.
Repeat this step for additional users, and then click Save.
Verify SSL VPN Client Connections
Use the show vpn-sessiondb svc command in order to verify connected SSL VPN clients.
ciscoasa(config-group-policy)#show vpn-sessiondb svc
Session Type: SVC
Username : matthewp Index : 6
Assigned IP : 192.168.25.1 Public IP : 172.18.12.111
Protocol : Clientless SSL-Tunnel DTLS-Tunnel
Encryption : RC4 AES128 Hashing : SHA1
Bytes Tx : 35466 Bytes Rx : 27543
Group Policy : SSLClientPolicy Tunnel Group : SSLClientProfile
Login Time : 20:06:59 UTC Tue Oct 16 2007
Duration : 0h:00m:12s
NAC Result : Unknown
VLAN Mapping : N/A VLAN : none
ciscoasa(config-group-policy)#
The vpn-sessiondb logoff name username command logs off users by user name. An Administrator Reset message is sent to the user when disconnected.
ciscoasa(config)#vpn-sessiondb logoff name matthewp
Do you want to logoff the VPN session(s)? [confirm]
INFO: Number of sessions with name "matthewp" logged off : 1
ciscoasa(config)#
Monday, July 27, 2009
Installing Backtrack 3 to a harddrive
I started with a clean drive, so you might have to manipulate your partition tables. I’m going to assume that you’re comfortable working with partition tables. If not, work on your google-fu.
Here are the steps I took to install Backtrack 3 on to my laptop harddrive
1. Boot system from Backtrack 3 CD.
2. Once booted, open a terminal and type cfdisk
3. Create these 3 partitons:
A. sda1=/boot
B. sda2=swap
C. sda3= /
NOTE: Format A and C using mkfs.ext3 /dev/sda1 and mkfs.ext3 /dev/sda3.
4. Boot your live CD and open a bash shell and begin. If your swap is not yet made then do this..(otherwise omit this step)
bt~# mkswap /dev/sda2
bt~# swapon /dev/sda2
5. Starting installation
bt~# mkdir /mnt/backtrack
bt~# mount /dev/sda3 /mnt/backtrack/
bt~# mkdir /mnt/backtrack/boot/
bt~# mount /dev/sda1 /mnt/backtrack/boot/
(note: If you only have one partiton to install backtrack to simply omit this step)
bt~# cp --preserve -R /{bin,dev,pentest,usr,etc,lib,opt,sbin,var,root} /mnt/backtrack/
bt~# mkdir /mnt/backtrack/{mnt,proc,sys,tmp,boot,root}
bt~# mount --bind /dev/ /mnt/backtrack/dev/
bt~# mount -t proc proc /mnt/backtrack/proc/
bt~# cp /boot/vmlinuz /mnt/backtrack/boot/
6. Now for lilo.
bt~# chroot /mnt/backtrack/ /bin/bash
bt~# nano /etc/lilo.conf
7. Now I like to delete all the BS in the lilo config file so here is what mine would look like. (remember to set your own VGA accordingly )
lba32
boot /dev/sda
prompt
timeout=60
change-rules
reset
vga=791
image = /boot/vmlinuz
root = /dev/sda3
label = backtrack3_final
GRUB users (Thanks to drwalter)
title Backtrack 3 KDE
rootnoverify (hd0,2)
kernel /boot/vmlinuz vga=791 root=/dev/sda3 ro autoexec=xconf;kdm
boot
title Backtrack 3
rootnoverify (hd0,2)
kernel /boot/vmlinuz vga=791 root=/dev/sda3 ro
boot
REMEMBER: hd0,2 would be for partition 3 NOT 2. Change accordingly!
Excellent. Save that and then execute lilo (I like to use the verbose flag)
bt~# lilo -v
after that exit your chroot enviorment
bt~# exit
and reboot and cross your fingers
bt~# reboot
Here are the steps I took to install Backtrack 3 on to my laptop harddrive
1. Boot system from Backtrack 3 CD.
2. Once booted, open a terminal and type cfdisk
3. Create these 3 partitons:
A. sda1=/boot
B. sda2=swap
C. sda3= /
NOTE: Format A and C using mkfs.ext3 /dev/sda1 and mkfs.ext3 /dev/sda3.
4. Boot your live CD and open a bash shell and begin. If your swap is not yet made then do this..(otherwise omit this step)
bt~# mkswap /dev/sda2
bt~# swapon /dev/sda2
5. Starting installation
bt~# mkdir /mnt/backtrack
bt~# mount /dev/sda3 /mnt/backtrack/
bt~# mkdir /mnt/backtrack/boot/
bt~# mount /dev/sda1 /mnt/backtrack/boot/
(note: If you only have one partiton to install backtrack to simply omit this step)
bt~# cp --preserve -R /{bin,dev,pentest,usr,etc,lib,opt,sbin,var,root} /mnt/backtrack/
bt~# mkdir /mnt/backtrack/{mnt,proc,sys,tmp,boot,root}
bt~# mount --bind /dev/ /mnt/backtrack/dev/
bt~# mount -t proc proc /mnt/backtrack/proc/
bt~# cp /boot/vmlinuz /mnt/backtrack/boot/
6. Now for lilo.
bt~# chroot /mnt/backtrack/ /bin/bash
bt~# nano /etc/lilo.conf
7. Now I like to delete all the BS in the lilo config file so here is what mine would look like. (remember to set your own VGA accordingly )
lba32
boot /dev/sda
prompt
timeout=60
change-rules
reset
vga=791
image = /boot/vmlinuz
root = /dev/sda3
label = backtrack3_final
GRUB users (Thanks to drwalter)
title Backtrack 3 KDE
rootnoverify (hd0,2)
kernel /boot/vmlinuz vga=791 root=/dev/sda3 ro autoexec=xconf;kdm
boot
title Backtrack 3
rootnoverify (hd0,2)
kernel /boot/vmlinuz vga=791 root=/dev/sda3 ro
boot
REMEMBER: hd0,2 would be for partition 3 NOT 2. Change accordingly!
Excellent. Save that and then execute lilo (I like to use the verbose flag)
bt~# lilo -v
after that exit your chroot enviorment
bt~# exit
and reboot and cross your fingers
bt~# reboot
BackTrack links
- BackTrack 4 Beta Hard Disk Install
- HowTo: Crack WPA with Backtrack 3
- HowTo: Crack WEP with BackTrack 3
- How To Install Backtrack4 Using Grub On Ubuntu
- How to install BT4 dualboot xp on your HDD without vmware or dvd disks
- Backtrack 4 – USB/Nessus Boot with Persistent Changes
- How to make Backtrack 4 boot from USB
- Installing Backtrack 3 to a harddrive
- HowTo: Backtrack 4 (Pre Release) Hard Drive Installation
- BT4 Install: Simplest way to install BackTrack4
Max The Battery Life Of Your New BlackBerry
battery life is known to be excellent on many BlackBerry models. However, other models often have shorter battery life.
Try this if you are a new BlackBerry owner.
1. You need to break in the BlackBerry battery. Charge-discharge it fully about 3 times. This will max the battery life of a fresh, new Lithium ion.
Note: once you do that, don't get in the habit of fully discharging the battery everytime -- to prevent wearing it out -- lithium batteries can be damaged with excessive deep discharges like a car battery can be.... When breaking in the battery, make sure you keep it plugged in long after the battery says it is fully charged (i.e. overnight), you really want to trickle-charge your BlackBerry to top-off your battery.
2. Lithium batteries LOVE to be topped-off. In regular use (After initial first-use conditioning), plug it in whenever you have the opportunity. This will also help keep the battery life maxed out for those days you really need long battery life.
3. If you are constantly starved for battery power, avoid continuously realtime software such as BBToday software; it uses a lot of battery power.
4. Keep your Bluetooth turned off when not in use.
5. If you use instant messaging software, leave it running in the background or quit it when not in use. Also, stay logged off the networks you do not use much.
6. When using your BlackBerry, make sure you keep the backlight turned low or off whenever possible (rather than bright mode).
7. Some BlackBerries have an extended battery available, such as the Nextel 7510. There may be an extended battery product for your specific BlackBerry product.
8. There's the novelty factor of using a BlackBerry for the first time; we tend to play with them much more heavily at first. So your usage may normallize after you get used to it.
9. If you haven't bought a BlackBerry yet, you should be aware that the GSM/GPRS BlackBerries have the longest battery life. Battery life is longer on GPRS BlackBerries than the CDMA and iDEN BlackBerries.
10. Phone calls made on your BlackBerry is the biggest consumer of battery life. If you make lots of phone calls for hours, then your battery life can be extremely short. Making phone calls in areas of weak reception will also use up more battery power.
11. Consider a car power kit, or an office charger/cable. That way, you have more opportunities to top-off your BlackBerry battery.
As noted earlier, it's always a good idea to top-off the battery in a BlackBerry anyway, even if it's not almost dead. It is not necessary to follow the age-old advice of using up the battery before charging, and can wear out modern lithium-ion batteries if done on a constant basis.
12. Your battery may be defective or worn out. Compare your battery life to other people using the same model of BlackBerry.
If you have been using your BlackBerry for a long time, it may be time to replace your battery. If you purchased your BlackBerry as used, you may want to replace the battery with a new one. For best battery life, it is generally best to use genuine brand-name batteries rather than inexpensive aftermarket batteries.
13. Occasionally, it may be a BlackBerryOS issue if you are having unusually short battery life all the time. Early versions of BlackBerryOS on the 7100 tended to use a lot more battery life than newer versions of BlackBerryOS. Upgrade to a newer version of BlackBerryOS.
Try this if you are a new BlackBerry owner.
1. You need to break in the BlackBerry battery. Charge-discharge it fully about 3 times. This will max the battery life of a fresh, new Lithium ion.
Note: once you do that, don't get in the habit of fully discharging the battery everytime -- to prevent wearing it out -- lithium batteries can be damaged with excessive deep discharges like a car battery can be.... When breaking in the battery, make sure you keep it plugged in long after the battery says it is fully charged (i.e. overnight), you really want to trickle-charge your BlackBerry to top-off your battery.
2. Lithium batteries LOVE to be topped-off. In regular use (After initial first-use conditioning), plug it in whenever you have the opportunity. This will also help keep the battery life maxed out for those days you really need long battery life.
3. If you are constantly starved for battery power, avoid continuously realtime software such as BBToday software; it uses a lot of battery power.
4. Keep your Bluetooth turned off when not in use.
5. If you use instant messaging software, leave it running in the background or quit it when not in use. Also, stay logged off the networks you do not use much.
6. When using your BlackBerry, make sure you keep the backlight turned low or off whenever possible (rather than bright mode).
7. Some BlackBerries have an extended battery available, such as the Nextel 7510. There may be an extended battery product for your specific BlackBerry product.
8. There's the novelty factor of using a BlackBerry for the first time; we tend to play with them much more heavily at first. So your usage may normallize after you get used to it.
9. If you haven't bought a BlackBerry yet, you should be aware that the GSM/GPRS BlackBerries have the longest battery life. Battery life is longer on GPRS BlackBerries than the CDMA and iDEN BlackBerries.
10. Phone calls made on your BlackBerry is the biggest consumer of battery life. If you make lots of phone calls for hours, then your battery life can be extremely short. Making phone calls in areas of weak reception will also use up more battery power.
11. Consider a car power kit, or an office charger/cable. That way, you have more opportunities to top-off your BlackBerry battery.
As noted earlier, it's always a good idea to top-off the battery in a BlackBerry anyway, even if it's not almost dead. It is not necessary to follow the age-old advice of using up the battery before charging, and can wear out modern lithium-ion batteries if done on a constant basis.
12. Your battery may be defective or worn out. Compare your battery life to other people using the same model of BlackBerry.
If you have been using your BlackBerry for a long time, it may be time to replace your battery. If you purchased your BlackBerry as used, you may want to replace the battery with a new one. For best battery life, it is generally best to use genuine brand-name batteries rather than inexpensive aftermarket batteries.
13. Occasionally, it may be a BlackBerryOS issue if you are having unusually short battery life all the time. Early versions of BlackBerryOS on the 7100 tended to use a lot more battery life than newer versions of BlackBerryOS. Upgrade to a newer version of BlackBerryOS.
MSSQL: View actively running commands by SPID
--- View actively running commands by SPID.
select session_id, Text
from sys.dm_exec_requests r
cross apply sys.dm_exec_sql_text(sql_handle) t
Troubleshooting
Backup failed: System.Data.SqlClient.SqlError: Backup and file manipulation... must be serialized
select session_id, Text
from sys.dm_exec_requests r
cross apply sys.dm_exec_sql_text(sql_handle) t
Troubleshooting
Backup failed: System.Data.SqlClient.SqlError: Backup and file manipulation... must be serialized
Run Scheduled Task Batch File to Run Minimized on Task Bar
Problem: Batch file running Perl script to parse and copy SQL log files every five minutes as a Scheduled Task in Windows was creating a DOS window on the console. This made working on the server difficult and dangerous.
Solution: Create another batch file for the Scheduler to run with the commands 'start /min '
The old batch file must have the command 'exit' at the end of it for the DOS window to close.
Solution: Create another batch file for the Scheduler to run with the commands 'start /min '
The old batch file must have the command 'exit' at the end of it for the DOS window to close.
Mac connect to Windows File Share
By default, Windows 2003 Server domain controllers have "Microsoft network server: Digitally sign communications (always)" set to "Enabled" by default. This is likely causing the Macs to fail to authenticate with the "error = -5000" when trying to connect via CIFS or SMB (samba)
To change this on a given domain controller, go to "Start" ->"Administrative Tools" -> "Domain Controller Security Policy" (not Domain Policy) and look for "Security Settings" -> "Local Policies" -> "Security Options" -> "Microsoft network server: Digitally sign communications (always)". It should show "Enabled" by default. Double-click on it and set to "Disabled".
Then close the app and click on start | Run - enter the command 'gpudate' to refresh group policy and hit enter.
You should now be able to use the "Go" > "Connect to Server" command in Finder to map to a share as shown below:
cifs://SERVER/SHARE
To change this on a given domain controller, go to "Start" ->"Administrative Tools" -> "Domain Controller Security Policy" (not Domain Policy) and look for "Security Settings" -> "Local Policies" -> "Security Options" -> "Microsoft network server: Digitally sign communications (always)". It should show "Enabled" by default. Double-click on it and set to "Disabled".
Then close the app and click on start | Run - enter the command 'gpudate' to refresh group policy and hit enter.
You should now be able to use the "Go" > "Connect to Server" command in Finder to map to a share as shown below:
cifs://SERVER/SHARE
MySQL Backup Shell Script
***TO CREATE BACKUP SCRIPT ON LOCAL SERVER
mkdir /root/bin
vi /root/bin/mysqlbak.sh (then copy script into this file)
change parameters in script to match database
chmod 755 /root/bin/mysqlback.sh
***TO VERIFY SCRIPT WORKS
1. run this command
/root/bin/mysqlbak.sh
2. when script is done, check subdirs of /var/backup/db/daily for tarred & gzipped backups
***TO SCHEDULE THIS TO RUN DAILY, CREATE SYMBOLIC LINK
ln -s /root/bin/mysqlbak.sh /etc/cron.daily/mysqlbak.sh
***TO RESTORE
mysql -uUSER -pPASSWORD DBNAME_RESTORE < DBNAME_BACKUPFILE.sql
#!/bin/bash
#
# MySQL Backup Script
# VER. 2.5 - http://sourceforge.net/projects/automysqlbackup/
# Copyright (c) 2002-2003 wipe_out@lycos.co.uk
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
#=====================================================================
#=====================================================================
# Set the following variables to your system needs
# (Detailed instructions below variables)
#=====================================================================
# crontab entry that will work for this script
# 57 5 * * 2,3,4,5,6 /root/bin/mysqlbackup.sh
# Username to access the MySQL server e.g. dbuser
USERNAME=
# Username to access the MySQL server e.g. password
PASSWORD=
# Host name (or IP address) of MySQL server e.g localhost
DBHOST=localhost
# List of DBNAMES for Daily/Weekly Backup e.g. "DB1 DB2 DB3" - you can put "all" as the value to backup all
DBNAMES=" mysql phpMyAdmin"
# Backup directory location e.g /var/www/backup/db
BACKUPDIR="/var/backup/db"
# Mail setup
# What would you like to be mailed to you?
# - log : send only log file
# - files : send log file and sql files as attachments (see docs)
# - stdout : will simply output the log to the screen if run manually.
# - quiet : Only send logs if an error occurs to the MAILADDR.
MAILCONTENT="log"
# Set the maximum allowed email size in k. (4000 = approx 5MB email [see docs])
MAXATTSIZE="4000"
# Email Address to send mail to? (user@domain.com)
MAILADDR="backups@soundenterprises.com"
# ============================================================
# === ADVANCED OPTIONS ( Read the doc's below for details )===
#=============================================================
# List of DBBNAMES for Monthly Backups.
MDBNAMES="mysql $DBNAMES"
# List of DBNAMES to EXCLUDE if DBNAMES are set to all (must be in " quotes)
DBEXCLUDE=""
# Include CREATE DATABASE in backup?
CREATE_DATABASE=yes
# Separate backup directory and file for each DB? (yes or no)
SEPDIR=yes
# Which day do you want weekly backups? (1 to 7 where 1 is Monday)
DOWEEKLY=7
# Choose Compression type. (gzip or bzip2)
COMP=gzip
# Compress communications between backup server and MySQL server?
COMMCOMP=no
# Additionally keep a copy of the most recent backup in a seperate directory.
LATEST=no
# The maximum size of the buffer for client/server communication. e.g. 16MB (maximum is 1GB)
MAX_ALLOWED_PACKET=
# For connections to localhost. Sometimes the Unix socket file must be specified.
SOCKET=
# Command to run before backups (uncomment to use)
#PREBACKUP="/etc/mysql-backup-pre"
# Command run after backups (uncomment to use)
#POSTBACKUP="/etc/mysql-backup-post"
#=====================================================================
# Options documantation
#=====================================================================
# Set USERNAME and PASSWORD of a user that has at least SELECT permission
# to ALL databases.
#
# Set the DBHOST option to the server you wish to backup, leave the
# default to backup "this server".(to backup multiple servers make
# copies of this file and set the options for that server)
#
# Put in the list of DBNAMES(Databases)to be backed up. If you would like
# to backup ALL DBs on the server set DBNAMES="all".(if set to "all" then
# any new DBs will automatically be backed up without needing to modify
# this backup script when a new DB is created).
#
# If the DB you want to backup has a space in the name replace the space
# with a % e.g. "data base" will become "data%base"
# NOTE: Spaces in DB names may not work correctly when SEPDIR=no.
#
# You can change the backup storage location from /backups to anything
# you like by using the BACKUPDIR setting..
#
# The MAILCONTENT and MAILADDR options and pretty self explanitory, use
# these to have the backup log mailed to you at any email address or multiple
# email addresses in a space seperated list.
# (If you set mail content to "log" you will require access to the "mail" program
# on your server. If you set this to "files" you will have to have mutt installed
# on your server. If you set it to "stdout" it will log to the screen if run from
# the console or to the cron job owner if run through cron. If you set it to "quiet"
# logs will only be mailed if there are errors reported. )
#
# MAXATTSIZE sets the largest allowed email attachments total (all backup files) you
# want the script to send. This is the size before it is encoded to be sent as an email
# so if your mail server will allow a maximum mail size of 5MB I would suggest setting
# MAXATTSIZE to be 25% smaller than that so a setting of 4000 would probably be fine.
#
# Finally copy automysqlbackup.sh to anywhere on your server and make sure
# to set executable permission. You can also copy the script to
# /etc/cron.daily to have it execute automatically every night or simply
# place a symlink in /etc/cron.daily to the file if you wish to keep it
# somwhere else.
# NOTE:On Debian copy the file with no extention for it to be run
# by cron e.g just name the file "automysqlbackup"
#
# Thats it..
#
#
# === Advanced options doc's ===
#
# The list of MDBNAMES is the DB's to be backed up only monthly. You should
# always include "mysql" in this list to backup your user/password
# information along with any other DBs that you only feel need to
# be backed up monthly. (if using a hosted server then you should
# probably remove "mysql" as your provider will be backing this up)
# NOTE: If DBNAMES="all" then MDBNAMES has no effect as all DBs will be backed
# up anyway.
#
# If you set DBNAMES="all" you can configure the option DBEXCLUDE. Other
# wise this option will not be used.
# This option can be used if you want to backup all dbs, but you want
# exclude some of them. (eg. a db is to big).
#
# Set CREATE_DATABASE to "yes" (the default) if you want your SQL-Dump to create
# a database with the same name as the original database when restoring.
# Saying "no" here will allow your to specify the database name you want to
# restore your dump into, making a copy of the database by using the dump
# created with automysqlbackup.
# NOTE: Not used if SEPDIR=no
#
# The SEPDIR option allows you to choose to have all DBs backed up to
# a single file (fast restore of entire server in case of crash) or to
# seperate directories for each DB (each DB can be restored seperately
# in case of single DB corruption or loss).
#
# To set the day of the week that you would like the weekly backup to happen
# set the DOWEEKLY setting, this can be a value from 1 to 7 where 1 is Monday,
# The default is 6 which means that weekly backups are done on a Saturday.
#
# COMP is used to choose the copmression used, options are gzip or bzip2.
# bzip2 will produce slightly smaller files but is more processor intensive so
# may take longer to complete.
#
# COMMCOMP is used to enable or diable mysql client to server compression, so
# it is useful to save bandwidth when backing up a remote MySQL server over
# the network.
#
# LATEST is to store an additional copy of the latest backup to a standard
# location so it can be downloaded bt thrid party scripts.
#
# If the DB's being backed up make use of large BLOB fields then you may need
# to increase the MAX_ALLOWED_PACKET setting, for example 16MB..
#
# When connecting to localhost as the DB server (DBHOST=localhost) sometimes
# the system can have issues locating the socket file.. This can now be set
# using the SOCKET parameter.. An example may be SOCKET=/private/tmp/mysql.sock
#
# Use PREBACKUP and POSTBACKUP to specify Per and Post backup commands
# or scripts to perform tasks either before or after the backup process.
#
#
#=====================================================================
# Backup Rotation..
#=====================================================================
#
# Daily Backups are rotated weekly..
# Weekly Backups are run by default on Saturday Morning when
# cron.daily scripts are run...Can be changed with DOWEEKLY setting..
# Weekly Backups are rotated on a 5 week cycle..
# Monthly Backups are run on the 1st of the month..
# Monthly Backups are NOT rotated automatically...
# It may be a good idea to copy Monthly backups offline or to another
# server..
#
#=====================================================================
# Please Note!!
#=====================================================================
#
# I take no resposibility for any data loss or corruption when using
# this script..
# This script will not help in the event of a hard drive crash. If a
# copy of the backup has not be stored offline or on another PC..
# You should copy your backups offline regularly for best protection.
#
# Happy backing up...
#
#=====================================================================
# Restoring
#=====================================================================
# Firstly you will need to uncompress the backup file.
# eg.
# gunzip file.gz (or bunzip2 file.bz2)
#
# Next you will need to use the mysql client to restore the DB from the
# sql file.
# eg.
# mysql --user=username --pass=password --host=dbserver database < /path/file.sql
# or
# mysql --user=username --pass=password --host=dbserver -e "source /path/file.sql" database
#
# NOTE: Make sure you use "<" and not ">" in the above command because
# you are piping the file.sql to mysql and not the other way around.
#
# Lets hope you never have to use this.. :)
#
#
#=====================================================================
#=====================================================================
#=====================================================================
#
# Should not need to be modified from here down!!
#
#=====================================================================
#=====================================================================
#=====================================================================
PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/mysql/bin
DATE=`date +%Y-%m-%d_%Hh%Mm` # Datestamp e.g 2002-09-21
DOW=`date +%A` # Day of the week e.g. Monday
DNOW=`date +%u` # Day number of the week 1 to 7 where 1 represents Monday
DOM=`date +%d` # Date of the Month e.g. 27
M=`date +%B` # Month e.g January
W=`date +%V` # Week Number e.g 37
VER=2.5 # Version Number
LOGFILE=$BACKUPDIR/$DBHOST-`date +%N`.log # Logfile Name
LOGERR=$BACKUPDIR/ERRORS_$DBHOST-`date +%N`.log # Logfile Name
BACKUPFILES=""
OPT="--quote-names --opt" # OPT string for use with mysqldump ( see man mysqldump )
# Add --compress mysqldump option to $OPT
if [ "$COMMCOMP" = "yes" ];
then
OPT="$OPT --compress"
fi
# Add --compress mysqldump option to $OPT
if [ "$MAX_ALLOWED_PACKET" ];
then
OPT="$OPT --max_allowed_packet=$MAX_ALLOWED_PACKET"
fi
# Create required directories
if [ ! -e "$BACKUPDIR" ] # Check Backup Directory exists.
then
mkdir -p "$BACKUPDIR"
fi
if [ ! -e "$BACKUPDIR/daily" ] # Check Daily Directory exists.
then
mkdir -p "$BACKUPDIR/daily"
fi
if [ ! -e "$BACKUPDIR/weekly" ] # Check Weekly Directory exists.
then
mkdir -p "$BACKUPDIR/weekly"
fi
if [ ! -e "$BACKUPDIR/monthly" ] # Check Monthly Directory exists.
then
mkdir -p "$BACKUPDIR/monthly"
fi
if [ "$LATEST" = "yes" ]
then
if [ ! -e "$BACKUPDIR/latest" ] # Check Latest Directory exists.
then
mkdir -p "$BACKUPDIR/latest"
fi
eval rm -fv "$BACKUPDIR/latest/*"
fi
# IO redirection for logging.
touch $LOGFILE
exec 6>&1 # Link file descriptor #6 with stdout.
# Saves stdout.
exec > $LOGFILE # stdout replaced with file $LOGFILE.
touch $LOGERR
exec 7>&2 # Link file descriptor #7 with stderr.
# Saves stderr.
exec 2> $LOGERR # stderr replaced with file $LOGERR.
# Functions
# Database dump function
dbdump () {
mysqldump --user=$USERNAME --password=$PASSWORD --host=$DBHOST $OPT $1 > $2
return 0
}
# Compression function plus latest copy
SUFFIX=""
compression () {
if [ "$COMP" = "gzip" ]; then
gzip -f "$1"
echo
echo Backup Information for "$1"
gzip -l "$1.gz"
SUFFIX=".gz"
elif [ "$COMP" = "bzip2" ]; then
echo Compression information for "$1.bz2"
bzip2 -f -v $1 2>&1
SUFFIX=".bz2"
else
echo "No compression option set, check advanced settings"
fi
if [ "$LATEST" = "yes" ]; then
cp $1$SUFFIX "$BACKUPDIR/latest/"
fi
return 0
}
# Run command before we begin
if [ "$PREBACKUP" ]
then
echo ======================================================================
echo "Prebackup command output."
echo
eval $PREBACKUP
echo
echo ======================================================================
echo
fi
if [ "$SEPDIR" = "yes" ]; then # Check if CREATE DATABSE should be included in Dump
if [ "$CREATE_DATABASE" = "no" ]; then
OPT="$OPT --no-create-db"
else
OPT="$OPT --databases"
fi
else
OPT="$OPT --databases"
fi
# Hostname for LOG information
if [ "$DBHOST" = "localhost" ]; then
HOST=`hostname`
if [ "$SOCKET" ]; then
OPT="$OPT --socket=$SOCKET"
fi
else
HOST=$DBHOST
fi
# If backing up all DBs on the server
if [ "$DBNAMES" = "all" ]; then
DBNAMES="`mysql --user=$USERNAME --password=$PASSWORD --host=$DBHOST --batch --skip-column-names -e "show databases"| sed 's/ /%/g'`"
# If DBs are excluded
for exclude in $DBEXCLUDE
do
DBNAMES=`echo $DBNAMES | sed "s/\b$exclude\b//g"`
done
MDBNAMES=$DBNAMES
fi
echo ======================================================================
echo AutoMySQLBackup VER $VER
echo http://sourceforge.net/projects/automysqlbackup/
echo
echo Backup of Database Server - $HOST
echo ======================================================================
# Test is seperate DB backups are required
if [ "$SEPDIR" = "yes" ]; then
echo Backup Start Time `date`
echo ======================================================================
# Monthly Full Backup of all Databases
if [ $DOM = "01" ]; then
for MDB in $MDBNAMES
do
# Prepare $DB for using
MDB="`echo $MDB | sed 's/%/ /g'`"
if [ ! -e "$BACKUPDIR/monthly/$MDB" ] # Check Monthly DB Directory exists.
then
mkdir -p "$BACKUPDIR/monthly/$MDB"
fi
echo Monthly Backup of $MDB...
dbdump "$MDB" "$BACKUPDIR/monthly/$MDB/${MDB}_$DATE.$M.$MDB.sql"
compression "$BACKUPDIR/monthly/$MDB/${MDB}_$DATE.$M.$MDB.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/monthly/$MDB/${MDB}_$DATE.$M.$MDB.sql$SUFFIX"
echo ----------------------------------------------------------------------
done
fi
for DB in $DBNAMES
do
# Prepare $DB for using
DB="`echo $DB | sed 's/%/ /g'`"
# Create Seperate directory for each DB
if [ ! -e "$BACKUPDIR/daily/$DB" ] # Check Daily DB Directory exists.
then
mkdir -p "$BACKUPDIR/daily/$DB"
fi
if [ ! -e "$BACKUPDIR/weekly/$DB" ] # Check Weekly DB Directory exists.
then
mkdir -p "$BACKUPDIR/weekly/$DB"
fi
# Weekly Backup
if [ $DNOW = $DOWEEKLY ]; then
echo Weekly Backup of Database \( $DB \)
echo Rotating 5 weeks Backups...
if [ "$W" -le 05 ];then
REMW=`expr 48 + $W`
elif [ "$W" -lt 15 ];then
REMW=0`expr $W - 5`
else
REMW=`expr $W - 5`
fi
eval rm -fv "$BACKUPDIR/weekly/$DB_week.$REMW.*"
echo
dbdump "$DB" "$BACKUPDIR/weekly/$DB/${DB}_week.$W.$DATE.sql"
compression "$BACKUPDIR/weekly/$DB/${DB}_week.$W.$DATE.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/weekly/$DB/${DB}_week.$W.$DATE.sql$SUFFIX"
echo ----------------------------------------------------------------------
# Daily Backup
else
echo Daily Backup of Database \( $DB \)
echo Rotating last weeks Backup...
eval rm -fv "$BACKUPDIR/daily/$DB/*.$DOW.sql.*"
echo
dbdump "$DB" "$BACKUPDIR/daily/$DB/${DB}_$DATE.$DOW.sql"
compression "$BACKUPDIR/daily/$DB/${DB}_$DATE.$DOW.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/daily/$DB/${DB}_$DATE.$DOW.sql$SUFFIX"
echo ----------------------------------------------------------------------
fi
done
echo Backup End `date`
echo ======================================================================
else # One backup file for all DBs
echo Backup Start `date`
echo ======================================================================
# Monthly Full Backup of all Databases
if [ $DOM = "01" ]; then
echo Monthly full Backup of \( $MDBNAMES \)...
dbdump "$MDBNAMES" "$BACKUPDIR/monthly/$DATE.$M.all-databases.sql"
compression "$BACKUPDIR/monthly/$DATE.$M.all-databases.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/monthly/$DATE.$M.all-databases.sql$SUFFIX"
echo ----------------------------------------------------------------------
fi
# Weekly Backup
if [ $DNOW = $DOWEEKLY ]; then
echo Weekly Backup of Databases \( $DBNAMES \)
echo
echo Rotating 5 weeks Backups...
if [ "$W" -le 05 ];then
REMW=`expr 48 + $W`
elif [ "$W" -lt 15 ];then
REMW=0`expr $W - 5`
else
REMW=`expr $W - 5`
fi
eval rm -fv "$BACKUPDIR/weekly/week.$REMW.*"
echo
dbdump "$DBNAMES" "$BACKUPDIR/weekly/week.$W.$DATE.sql"
compression "$BACKUPDIR/weekly/week.$W.$DATE.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/weekly/week.$W.$DATE.sql$SUFFIX"
echo ----------------------------------------------------------------------
# Daily Backup
else
echo Daily Backup of Databases \( $DBNAMES \)
echo
echo Rotating last weeks Backup...
eval rm -fv "$BACKUPDIR/daily/*.$DOW.sql.*"
echo
dbdump "$DBNAMES" "$BACKUPDIR/daily/$DATE.$DOW.sql"
compression "$BACKUPDIR/daily/$DATE.$DOW.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/daily/$DATE.$DOW.sql$SUFFIX"
echo ----------------------------------------------------------------------
fi
echo Backup End Time `date`
echo ======================================================================
fi
echo Total disk space used for backup storage..
echo Size - Location
echo `du -hs "$BACKUPDIR"`
echo
echo ======================================================================
echo If you find AutoMySQLBackup valuable please make a donation at
echo http://sourceforge.net/project/project_donations.php?group_id=101066
echo ======================================================================
# Run command when we're done
if [ "$POSTBACKUP" ]
then
echo ======================================================================
echo "Postbackup command output."
echo
eval $POSTBACKUP
echo
echo ======================================================================
fi
#Clean up IO redirection
exec 1>&6 6>&- # Restore stdout and close file descriptor #6.
exec 1>&7 7>&- # Restore stdout and close file descriptor #7.
if [ "$MAILCONTENT" = "files" ]
then
if [ -s "$LOGERR" ]
then
# Include error log if is larger than zero.
BACKUPFILES="$BACKUPFILES $LOGERR"
ERRORNOTE="WARNING: Error Reported - "
fi
#Get backup size
ATTSIZE=`du -c $BACKUPFILES | grep "[[:digit:][:space:]]total$" |sed s/\s*total//`
if [ $MAXATTSIZE -ge $ATTSIZE ]
then
BACKUPFILES=`echo "$BACKUPFILES" | sed -e "s# # -a #g"` #enable multiple attachments
mutt -s "$ERRORNOTE MySQL Backup Log and SQL Files for $HOST - $DATE" $BACKUPFILES $MAILADDR < $LOGFILE #send via mutt
else
cat "$LOGFILE" | mail -s "WARNING! - MySQL Backup exceeds set maximum attachment size on $HOST - $DATE" $MAILADDR
fi
elif [ "$MAILCONTENT" = "log" ]
then
cat "$LOGFILE" | mail -s "MySQL Backup Log for $HOST - $DATE" $MAILADDR
if [ -s "$LOGERR" ]
then
cat "$LOGERR" | mail -s "ERRORS REPORTED: MySQL Backup error Log for $HOST - $DATE" $MAILADDR
fi
elif [ "$MAILCONTENT" = "quiet" ]
then
if [ -s "$LOGERR" ]
then
cat "$LOGERR" | mail -s "ERRORS REPORTED: MySQL Backup error Log for $HOST - $DATE" $MAILADDR
cat "$LOGFILE" | mail -s "MySQL Backup Log for $HOST - $DATE" $MAILADDR
fi
else
if [ -s "$LOGERR" ]
then
cat "$LOGFILE"
echo
echo "###### WARNING ######"
echo "Errors reported during AutoMySQLBackup execution.. Backup failed"
echo "Error log below.."
cat "$LOGERR"
else
cat "$LOGFILE"
fi
fi
if [ -s "$LOGERR" ]
then
STATUS=1
else
STATUS=0
fi
# Clean up Logfile
eval rm -f "$LOGFILE"
eval rm -f "$LOGERR"
exit $STATUS
mkdir /root/bin
vi /root/bin/mysqlbak.sh (then copy script into this file)
change parameters in script to match database
chmod 755 /root/bin/mysqlback.sh
***TO VERIFY SCRIPT WORKS
1. run this command
/root/bin/mysqlbak.sh
2. when script is done, check subdirs of /var/backup/db/daily for tarred & gzipped backups
***TO SCHEDULE THIS TO RUN DAILY, CREATE SYMBOLIC LINK
ln -s /root/bin/mysqlbak.sh /etc/cron.daily/mysqlbak.sh
***TO RESTORE
mysql -uUSER -pPASSWORD DBNAME_RESTORE < DBNAME_BACKUPFILE.sql
#!/bin/bash
#
# MySQL Backup Script
# VER. 2.5 - http://sourceforge.net/projects/automysqlbackup/
# Copyright (c) 2002-2003 wipe_out@lycos.co.uk
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
#=====================================================================
#=====================================================================
# Set the following variables to your system needs
# (Detailed instructions below variables)
#=====================================================================
# crontab entry that will work for this script
# 57 5 * * 2,3,4,5,6 /root/bin/mysqlbackup.sh
# Username to access the MySQL server e.g. dbuser
USERNAME=
# Username to access the MySQL server e.g. password
PASSWORD=
# Host name (or IP address) of MySQL server e.g localhost
DBHOST=localhost
# List of DBNAMES for Daily/Weekly Backup e.g. "DB1 DB2 DB3" - you can put "all" as the value to backup all
DBNAMES=" mysql phpMyAdmin"
# Backup directory location e.g /var/www/backup/db
BACKUPDIR="/var/backup/db"
# Mail setup
# What would you like to be mailed to you?
# - log : send only log file
# - files : send log file and sql files as attachments (see docs)
# - stdout : will simply output the log to the screen if run manually.
# - quiet : Only send logs if an error occurs to the MAILADDR.
MAILCONTENT="log"
# Set the maximum allowed email size in k. (4000 = approx 5MB email [see docs])
MAXATTSIZE="4000"
# Email Address to send mail to? (user@domain.com)
MAILADDR="backups@soundenterprises.com"
# ============================================================
# === ADVANCED OPTIONS ( Read the doc's below for details )===
#=============================================================
# List of DBBNAMES for Monthly Backups.
MDBNAMES="mysql $DBNAMES"
# List of DBNAMES to EXCLUDE if DBNAMES are set to all (must be in " quotes)
DBEXCLUDE=""
# Include CREATE DATABASE in backup?
CREATE_DATABASE=yes
# Separate backup directory and file for each DB? (yes or no)
SEPDIR=yes
# Which day do you want weekly backups? (1 to 7 where 1 is Monday)
DOWEEKLY=7
# Choose Compression type. (gzip or bzip2)
COMP=gzip
# Compress communications between backup server and MySQL server?
COMMCOMP=no
# Additionally keep a copy of the most recent backup in a seperate directory.
LATEST=no
# The maximum size of the buffer for client/server communication. e.g. 16MB (maximum is 1GB)
MAX_ALLOWED_PACKET=
# For connections to localhost. Sometimes the Unix socket file must be specified.
SOCKET=
# Command to run before backups (uncomment to use)
#PREBACKUP="/etc/mysql-backup-pre"
# Command run after backups (uncomment to use)
#POSTBACKUP="/etc/mysql-backup-post"
#=====================================================================
# Options documantation
#=====================================================================
# Set USERNAME and PASSWORD of a user that has at least SELECT permission
# to ALL databases.
#
# Set the DBHOST option to the server you wish to backup, leave the
# default to backup "this server".(to backup multiple servers make
# copies of this file and set the options for that server)
#
# Put in the list of DBNAMES(Databases)to be backed up. If you would like
# to backup ALL DBs on the server set DBNAMES="all".(if set to "all" then
# any new DBs will automatically be backed up without needing to modify
# this backup script when a new DB is created).
#
# If the DB you want to backup has a space in the name replace the space
# with a % e.g. "data base" will become "data%base"
# NOTE: Spaces in DB names may not work correctly when SEPDIR=no.
#
# You can change the backup storage location from /backups to anything
# you like by using the BACKUPDIR setting..
#
# The MAILCONTENT and MAILADDR options and pretty self explanitory, use
# these to have the backup log mailed to you at any email address or multiple
# email addresses in a space seperated list.
# (If you set mail content to "log" you will require access to the "mail" program
# on your server. If you set this to "files" you will have to have mutt installed
# on your server. If you set it to "stdout" it will log to the screen if run from
# the console or to the cron job owner if run through cron. If you set it to "quiet"
# logs will only be mailed if there are errors reported. )
#
# MAXATTSIZE sets the largest allowed email attachments total (all backup files) you
# want the script to send. This is the size before it is encoded to be sent as an email
# so if your mail server will allow a maximum mail size of 5MB I would suggest setting
# MAXATTSIZE to be 25% smaller than that so a setting of 4000 would probably be fine.
#
# Finally copy automysqlbackup.sh to anywhere on your server and make sure
# to set executable permission. You can also copy the script to
# /etc/cron.daily to have it execute automatically every night or simply
# place a symlink in /etc/cron.daily to the file if you wish to keep it
# somwhere else.
# NOTE:On Debian copy the file with no extention for it to be run
# by cron e.g just name the file "automysqlbackup"
#
# Thats it..
#
#
# === Advanced options doc's ===
#
# The list of MDBNAMES is the DB's to be backed up only monthly. You should
# always include "mysql" in this list to backup your user/password
# information along with any other DBs that you only feel need to
# be backed up monthly. (if using a hosted server then you should
# probably remove "mysql" as your provider will be backing this up)
# NOTE: If DBNAMES="all" then MDBNAMES has no effect as all DBs will be backed
# up anyway.
#
# If you set DBNAMES="all" you can configure the option DBEXCLUDE. Other
# wise this option will not be used.
# This option can be used if you want to backup all dbs, but you want
# exclude some of them. (eg. a db is to big).
#
# Set CREATE_DATABASE to "yes" (the default) if you want your SQL-Dump to create
# a database with the same name as the original database when restoring.
# Saying "no" here will allow your to specify the database name you want to
# restore your dump into, making a copy of the database by using the dump
# created with automysqlbackup.
# NOTE: Not used if SEPDIR=no
#
# The SEPDIR option allows you to choose to have all DBs backed up to
# a single file (fast restore of entire server in case of crash) or to
# seperate directories for each DB (each DB can be restored seperately
# in case of single DB corruption or loss).
#
# To set the day of the week that you would like the weekly backup to happen
# set the DOWEEKLY setting, this can be a value from 1 to 7 where 1 is Monday,
# The default is 6 which means that weekly backups are done on a Saturday.
#
# COMP is used to choose the copmression used, options are gzip or bzip2.
# bzip2 will produce slightly smaller files but is more processor intensive so
# may take longer to complete.
#
# COMMCOMP is used to enable or diable mysql client to server compression, so
# it is useful to save bandwidth when backing up a remote MySQL server over
# the network.
#
# LATEST is to store an additional copy of the latest backup to a standard
# location so it can be downloaded bt thrid party scripts.
#
# If the DB's being backed up make use of large BLOB fields then you may need
# to increase the MAX_ALLOWED_PACKET setting, for example 16MB..
#
# When connecting to localhost as the DB server (DBHOST=localhost) sometimes
# the system can have issues locating the socket file.. This can now be set
# using the SOCKET parameter.. An example may be SOCKET=/private/tmp/mysql.sock
#
# Use PREBACKUP and POSTBACKUP to specify Per and Post backup commands
# or scripts to perform tasks either before or after the backup process.
#
#
#=====================================================================
# Backup Rotation..
#=====================================================================
#
# Daily Backups are rotated weekly..
# Weekly Backups are run by default on Saturday Morning when
# cron.daily scripts are run...Can be changed with DOWEEKLY setting..
# Weekly Backups are rotated on a 5 week cycle..
# Monthly Backups are run on the 1st of the month..
# Monthly Backups are NOT rotated automatically...
# It may be a good idea to copy Monthly backups offline or to another
# server..
#
#=====================================================================
# Please Note!!
#=====================================================================
#
# I take no resposibility for any data loss or corruption when using
# this script..
# This script will not help in the event of a hard drive crash. If a
# copy of the backup has not be stored offline or on another PC..
# You should copy your backups offline regularly for best protection.
#
# Happy backing up...
#
#=====================================================================
# Restoring
#=====================================================================
# Firstly you will need to uncompress the backup file.
# eg.
# gunzip file.gz (or bunzip2 file.bz2)
#
# Next you will need to use the mysql client to restore the DB from the
# sql file.
# eg.
# mysql --user=username --pass=password --host=dbserver database < /path/file.sql
# or
# mysql --user=username --pass=password --host=dbserver -e "source /path/file.sql" database
#
# NOTE: Make sure you use "<" and not ">" in the above command because
# you are piping the file.sql to mysql and not the other way around.
#
# Lets hope you never have to use this.. :)
#
#
#=====================================================================
#=====================================================================
#=====================================================================
#
# Should not need to be modified from here down!!
#
#=====================================================================
#=====================================================================
#=====================================================================
PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/mysql/bin
DATE=`date +%Y-%m-%d_%Hh%Mm` # Datestamp e.g 2002-09-21
DOW=`date +%A` # Day of the week e.g. Monday
DNOW=`date +%u` # Day number of the week 1 to 7 where 1 represents Monday
DOM=`date +%d` # Date of the Month e.g. 27
M=`date +%B` # Month e.g January
W=`date +%V` # Week Number e.g 37
VER=2.5 # Version Number
LOGFILE=$BACKUPDIR/$DBHOST-`date +%N`.log # Logfile Name
LOGERR=$BACKUPDIR/ERRORS_$DBHOST-`date +%N`.log # Logfile Name
BACKUPFILES=""
OPT="--quote-names --opt" # OPT string for use with mysqldump ( see man mysqldump )
# Add --compress mysqldump option to $OPT
if [ "$COMMCOMP" = "yes" ];
then
OPT="$OPT --compress"
fi
# Add --compress mysqldump option to $OPT
if [ "$MAX_ALLOWED_PACKET" ];
then
OPT="$OPT --max_allowed_packet=$MAX_ALLOWED_PACKET"
fi
# Create required directories
if [ ! -e "$BACKUPDIR" ] # Check Backup Directory exists.
then
mkdir -p "$BACKUPDIR"
fi
if [ ! -e "$BACKUPDIR/daily" ] # Check Daily Directory exists.
then
mkdir -p "$BACKUPDIR/daily"
fi
if [ ! -e "$BACKUPDIR/weekly" ] # Check Weekly Directory exists.
then
mkdir -p "$BACKUPDIR/weekly"
fi
if [ ! -e "$BACKUPDIR/monthly" ] # Check Monthly Directory exists.
then
mkdir -p "$BACKUPDIR/monthly"
fi
if [ "$LATEST" = "yes" ]
then
if [ ! -e "$BACKUPDIR/latest" ] # Check Latest Directory exists.
then
mkdir -p "$BACKUPDIR/latest"
fi
eval rm -fv "$BACKUPDIR/latest/*"
fi
# IO redirection for logging.
touch $LOGFILE
exec 6>&1 # Link file descriptor #6 with stdout.
# Saves stdout.
exec > $LOGFILE # stdout replaced with file $LOGFILE.
touch $LOGERR
exec 7>&2 # Link file descriptor #7 with stderr.
# Saves stderr.
exec 2> $LOGERR # stderr replaced with file $LOGERR.
# Functions
# Database dump function
dbdump () {
mysqldump --user=$USERNAME --password=$PASSWORD --host=$DBHOST $OPT $1 > $2
return 0
}
# Compression function plus latest copy
SUFFIX=""
compression () {
if [ "$COMP" = "gzip" ]; then
gzip -f "$1"
echo
echo Backup Information for "$1"
gzip -l "$1.gz"
SUFFIX=".gz"
elif [ "$COMP" = "bzip2" ]; then
echo Compression information for "$1.bz2"
bzip2 -f -v $1 2>&1
SUFFIX=".bz2"
else
echo "No compression option set, check advanced settings"
fi
if [ "$LATEST" = "yes" ]; then
cp $1$SUFFIX "$BACKUPDIR/latest/"
fi
return 0
}
# Run command before we begin
if [ "$PREBACKUP" ]
then
echo ======================================================================
echo "Prebackup command output."
echo
eval $PREBACKUP
echo
echo ======================================================================
echo
fi
if [ "$SEPDIR" = "yes" ]; then # Check if CREATE DATABSE should be included in Dump
if [ "$CREATE_DATABASE" = "no" ]; then
OPT="$OPT --no-create-db"
else
OPT="$OPT --databases"
fi
else
OPT="$OPT --databases"
fi
# Hostname for LOG information
if [ "$DBHOST" = "localhost" ]; then
HOST=`hostname`
if [ "$SOCKET" ]; then
OPT="$OPT --socket=$SOCKET"
fi
else
HOST=$DBHOST
fi
# If backing up all DBs on the server
if [ "$DBNAMES" = "all" ]; then
DBNAMES="`mysql --user=$USERNAME --password=$PASSWORD --host=$DBHOST --batch --skip-column-names -e "show databases"| sed 's/ /%/g'`"
# If DBs are excluded
for exclude in $DBEXCLUDE
do
DBNAMES=`echo $DBNAMES | sed "s/\b$exclude\b//g"`
done
MDBNAMES=$DBNAMES
fi
echo ======================================================================
echo AutoMySQLBackup VER $VER
echo http://sourceforge.net/projects/automysqlbackup/
echo
echo Backup of Database Server - $HOST
echo ======================================================================
# Test is seperate DB backups are required
if [ "$SEPDIR" = "yes" ]; then
echo Backup Start Time `date`
echo ======================================================================
# Monthly Full Backup of all Databases
if [ $DOM = "01" ]; then
for MDB in $MDBNAMES
do
# Prepare $DB for using
MDB="`echo $MDB | sed 's/%/ /g'`"
if [ ! -e "$BACKUPDIR/monthly/$MDB" ] # Check Monthly DB Directory exists.
then
mkdir -p "$BACKUPDIR/monthly/$MDB"
fi
echo Monthly Backup of $MDB...
dbdump "$MDB" "$BACKUPDIR/monthly/$MDB/${MDB}_$DATE.$M.$MDB.sql"
compression "$BACKUPDIR/monthly/$MDB/${MDB}_$DATE.$M.$MDB.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/monthly/$MDB/${MDB}_$DATE.$M.$MDB.sql$SUFFIX"
echo ----------------------------------------------------------------------
done
fi
for DB in $DBNAMES
do
# Prepare $DB for using
DB="`echo $DB | sed 's/%/ /g'`"
# Create Seperate directory for each DB
if [ ! -e "$BACKUPDIR/daily/$DB" ] # Check Daily DB Directory exists.
then
mkdir -p "$BACKUPDIR/daily/$DB"
fi
if [ ! -e "$BACKUPDIR/weekly/$DB" ] # Check Weekly DB Directory exists.
then
mkdir -p "$BACKUPDIR/weekly/$DB"
fi
# Weekly Backup
if [ $DNOW = $DOWEEKLY ]; then
echo Weekly Backup of Database \( $DB \)
echo Rotating 5 weeks Backups...
if [ "$W" -le 05 ];then
REMW=`expr 48 + $W`
elif [ "$W" -lt 15 ];then
REMW=0`expr $W - 5`
else
REMW=`expr $W - 5`
fi
eval rm -fv "$BACKUPDIR/weekly/$DB_week.$REMW.*"
echo
dbdump "$DB" "$BACKUPDIR/weekly/$DB/${DB}_week.$W.$DATE.sql"
compression "$BACKUPDIR/weekly/$DB/${DB}_week.$W.$DATE.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/weekly/$DB/${DB}_week.$W.$DATE.sql$SUFFIX"
echo ----------------------------------------------------------------------
# Daily Backup
else
echo Daily Backup of Database \( $DB \)
echo Rotating last weeks Backup...
eval rm -fv "$BACKUPDIR/daily/$DB/*.$DOW.sql.*"
echo
dbdump "$DB" "$BACKUPDIR/daily/$DB/${DB}_$DATE.$DOW.sql"
compression "$BACKUPDIR/daily/$DB/${DB}_$DATE.$DOW.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/daily/$DB/${DB}_$DATE.$DOW.sql$SUFFIX"
echo ----------------------------------------------------------------------
fi
done
echo Backup End `date`
echo ======================================================================
else # One backup file for all DBs
echo Backup Start `date`
echo ======================================================================
# Monthly Full Backup of all Databases
if [ $DOM = "01" ]; then
echo Monthly full Backup of \( $MDBNAMES \)...
dbdump "$MDBNAMES" "$BACKUPDIR/monthly/$DATE.$M.all-databases.sql"
compression "$BACKUPDIR/monthly/$DATE.$M.all-databases.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/monthly/$DATE.$M.all-databases.sql$SUFFIX"
echo ----------------------------------------------------------------------
fi
# Weekly Backup
if [ $DNOW = $DOWEEKLY ]; then
echo Weekly Backup of Databases \( $DBNAMES \)
echo
echo Rotating 5 weeks Backups...
if [ "$W" -le 05 ];then
REMW=`expr 48 + $W`
elif [ "$W" -lt 15 ];then
REMW=0`expr $W - 5`
else
REMW=`expr $W - 5`
fi
eval rm -fv "$BACKUPDIR/weekly/week.$REMW.*"
echo
dbdump "$DBNAMES" "$BACKUPDIR/weekly/week.$W.$DATE.sql"
compression "$BACKUPDIR/weekly/week.$W.$DATE.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/weekly/week.$W.$DATE.sql$SUFFIX"
echo ----------------------------------------------------------------------
# Daily Backup
else
echo Daily Backup of Databases \( $DBNAMES \)
echo
echo Rotating last weeks Backup...
eval rm -fv "$BACKUPDIR/daily/*.$DOW.sql.*"
echo
dbdump "$DBNAMES" "$BACKUPDIR/daily/$DATE.$DOW.sql"
compression "$BACKUPDIR/daily/$DATE.$DOW.sql"
BACKUPFILES="$BACKUPFILES $BACKUPDIR/daily/$DATE.$DOW.sql$SUFFIX"
echo ----------------------------------------------------------------------
fi
echo Backup End Time `date`
echo ======================================================================
fi
echo Total disk space used for backup storage..
echo Size - Location
echo `du -hs "$BACKUPDIR"`
echo
echo ======================================================================
echo If you find AutoMySQLBackup valuable please make a donation at
echo http://sourceforge.net/project/project_donations.php?group_id=101066
echo ======================================================================
# Run command when we're done
if [ "$POSTBACKUP" ]
then
echo ======================================================================
echo "Postbackup command output."
echo
eval $POSTBACKUP
echo
echo ======================================================================
fi
#Clean up IO redirection
exec 1>&6 6>&- # Restore stdout and close file descriptor #6.
exec 1>&7 7>&- # Restore stdout and close file descriptor #7.
if [ "$MAILCONTENT" = "files" ]
then
if [ -s "$LOGERR" ]
then
# Include error log if is larger than zero.
BACKUPFILES="$BACKUPFILES $LOGERR"
ERRORNOTE="WARNING: Error Reported - "
fi
#Get backup size
ATTSIZE=`du -c $BACKUPFILES | grep "[[:digit:][:space:]]total$" |sed s/\s*total//`
if [ $MAXATTSIZE -ge $ATTSIZE ]
then
BACKUPFILES=`echo "$BACKUPFILES" | sed -e "s# # -a #g"` #enable multiple attachments
mutt -s "$ERRORNOTE MySQL Backup Log and SQL Files for $HOST - $DATE" $BACKUPFILES $MAILADDR < $LOGFILE #send via mutt
else
cat "$LOGFILE" | mail -s "WARNING! - MySQL Backup exceeds set maximum attachment size on $HOST - $DATE" $MAILADDR
fi
elif [ "$MAILCONTENT" = "log" ]
then
cat "$LOGFILE" | mail -s "MySQL Backup Log for $HOST - $DATE" $MAILADDR
if [ -s "$LOGERR" ]
then
cat "$LOGERR" | mail -s "ERRORS REPORTED: MySQL Backup error Log for $HOST - $DATE" $MAILADDR
fi
elif [ "$MAILCONTENT" = "quiet" ]
then
if [ -s "$LOGERR" ]
then
cat "$LOGERR" | mail -s "ERRORS REPORTED: MySQL Backup error Log for $HOST - $DATE" $MAILADDR
cat "$LOGFILE" | mail -s "MySQL Backup Log for $HOST - $DATE" $MAILADDR
fi
else
if [ -s "$LOGERR" ]
then
cat "$LOGFILE"
echo
echo "###### WARNING ######"
echo "Errors reported during AutoMySQLBackup execution.. Backup failed"
echo "Error log below.."
cat "$LOGERR"
else
cat "$LOGFILE"
fi
fi
if [ -s "$LOGERR" ]
then
STATUS=1
else
STATUS=0
fi
# Clean up Logfile
eval rm -f "$LOGFILE"
eval rm -f "$LOGERR"
exit $STATUS
Subscribe to:
Posts (Atom)