Time Machine like Backups on OpenBSD
$Id: timemachine.gmi,v 1.2 2022/05/28 14:57:21 cvs Exp $
Time Machine[a] is a backup software by Apple, part of macOS allowing easy and foolproof backups. In a nutshell, it creates incremental backups on a storage medium of your choice and you can access the data either with a graphical client or directly via file system tools. I especially like that you only have to plug in an external USB drive which is immediately recognized, the backup starts and the drive is unmounted as soon as the backup is done. Since Time Machine is Apple only and I use OpenBSD on all my personal machines, I decided to write my own Time Machine like solution.
Goals of my Solution
- Automatic, incremental backups as soon as an external USB device is connected
- Automatic unmounting as soon as the backup is finished
- All data is fully encrypted
- No proprietary backup format, just plain files on disk
Turns out, I can solve the goals easily with mostly base software and one program from ports.
Prepare the external Storage
At first, we need to manually format the disk and create an encrypted file system on top. Plug in the disk and find the correct device name by looking at the dmesg output:
In this example itās sd2. Now we need to format the disk and create an encrypted file system on top of it.
Upon completion you should see a correct disklabel on the disk.
Since the disk is later controlled by a script we cannot use a passphrase here, we need to store the decryption password in a file. Use the tool of your choice to generate a strong password and store it in a file. To match the passphrase and the disk, name the file after the disks duid (can been seen in disklabelās output above). As last step, set the fileās permission to 600 so that only the owner can access it. Otherwise, bioctl complains about wrong permissions.
Make sure that you save the file in a secure location on your machine. In my case itās stored in /root and owned by the root user. Further, write the generated password somewhere down in case you need to access your backup disk without (!) having access to your machine! You could print it on a piece of paper and store it somewhere safe.
Now we need to create an encrypted diskabel within the previous one using the fileās content as passphrase:
To double test that everything works as designed, detach and re-attach the disk:
Now we create a file system where the backups will be stored. Using the -O 2 option we can force newfs to create a FFS2 file system.
The external disk is now ready to be used.
Recognize the disk upon Connection
Now, we make sure that the disk is recognized by the system as soon as itās connected. This can be easily done with hotplugd[a]. To identify the disk we look at the disklabel of each attached disk and run a script as soon as itās connected.
So what does the script above? It is called by hotplugd every time a device is attached. It checks if a disk is attached (DEVCLASS is 2) and then get the diskās duid from disklabel. If the duid matches the on from the backup disk (f5a87db156d32c6f in our case), it starts a script called /root/openbsd-timemachine-backup.sh. The script gets three parameters:
- The duid of the USB disk
- The duid of the encrypted disklabel within the first one
- Full path to the file with the passphrase
It also logs some information to syslog to make you aware that a backup disk is connected.
Install and configure rsnapshot
rsnapshot[a] is used for backing up the data. According to the website ārsnapshot is a file system snapshot utility based on rsync. rsnapshot makes it easy to make periodic snapshots of local machines, and remote machines over ssh. The code makes extensive use of hard links whenever possible, to greatly reduce the disk space required.ā So, exactly what weāre looking after.
Install it from ports:
The simplest way to configure it, is to copy the example config from /usr/local/share/examples/rsnapshot/rsnapshot.conf.default to /etc/rsnapshot.conf and adapt it as needed. The things you need to configure to make it work with the script below are as follows:
Keep the Greek letter names (alpha, beta, ā¦) for the backup levels. Depending on your available backup disk size you might want to tune the number of snapshots to be retained. To make sure that rsnapshot works as expected mount your backup drive to /backup and run it once. Check for errors and resolve them, if needed.
If rsnapshot works as expected we can now configure the script that runs it automatically.
The backup script
The script[a] is quite simple and just decrypts the disk, mounts it and runs rsnapshot to create an incremental backup. You should not need to change something, however, double check the following points:
- To avoid nested mounts, the script uses /backup as mount point for the external device. If you prefer another location you have to change the MNTPOIN variable at the beginning of the script and donāt forget to change rsnapshotās config as well.
- As seen above, I created the outer partition as sdXa (note the small letter āaā) and the inner partition as sdXi (note the small letter āiā). If you chose a different partition in disklabel you have to change the bioctl and mount commands.
- If you chose different names for rsnapshotās backup levels (so others that alpha, beta, ā¦) you have to modify the script accordingly.
Upon the first call, a counter is written to the backup disk. Every 8th run, a rsnapshot gamma backup is done, every 4th run a beta backup, and an alpha backup on all other runs.
Once you connect the disk you should see a backup job running and similar output to the following in /var/log/messages (timestamps cut):