F5 Automated Backups - The Right Way
Hi all,
Often I've been scouring the devcentral fora and codeshares to find that one piece of handywork that will drastically simplify my automated backup needs on F5 devices. Based on the works of Jason Rahm in his post "Third Time's the Charm: BIG-IP Backups Simplified with iCall" on the 26th of June 2013, I went ahead and created my own iApp that pretty much provides the answers for all my backup-needs.
Here's a feature list of this iApp:
- It allows you to choose between both UCS or SCF as backup-types. (whilst providing ample warnings about SCF not being a very good restore-option due to the incompleteness in some cases)
- It allows you to provide a passphrase for the UCS archives (the standard GUI also does this, so the iApp should too)
- It allows you to not include the private keys (same thing: standard GUI does it, so the iApp does it too)
- It allows you to set a Backup Schedule for every X minutes/hours/days/weeks/months or a custom selection of days in the week
- It allows you to set the exact time, minute of the hour, day of the week or day of the month when the backup should be performed (depending on the usefulness with regards to the schedule type)
- It allows you to transfer the backup files to external devices using 4 different protocols, next to providing local storage on the device itself
- SCP (username/private key without password)
- SFTP (username/private key without password)
- FTP (username/password)
- SMB (using smbclient, with username/password)
- Local Storage (/var/local/ucs or /var/local/scf)
- It stores all passwords and private keys in a secure fashion: encrypted by the master key of the unit (f5mku), rendering it safe to store the backups, including the credentials off-box
- It has a configurable automatic pruning function for the Local Storage option, so the disk doesn't fill up (i.e. keep last X backup files)
- It allows you to configure the filename using the date/time wildcards from the tcl [clock] command, as well as providing a variable to include the hostname
- It requires only the WebGUI to establish the configuration you desire
- It allows you to disable the processes for automated backup, without you having to remove the Application Service or losing any previously entered settings
- For the external shellscripts it automatically generates, the credentials are stored in encrypted form (using the master key)
- It allows you to no longer be required to make modifications on the linux command line to get your automated backups running after an RMA or restore operation
- It cleans up after itself, which means there are no extraneous shellscripts or status files lingering around after the scripts execute
I wasn't able to upload the iApp template to this article, so I threw it on pastebin: http://pastebin.com/YbDj3eMN
Enjoy!
Thomas Schockaert
Published Mar 13, 2014
Version 1.0
Thomas_Schocka1
Altocumulus
AltocumulusThomas_Schocka1Altocumulus
Altocumulus
Thomas_Schocka1Hi Gert,
Does it also work when you specify the private key file (which you upload manually, in unencrypted format, to the F5 first, for testing purposes only) on the commandline while doing an ssh command?
Steps:
1) copy contents of private key file to a file on the F5
2) run the command "ssh -i /path/to/private/key/file myusername@10.1.2.3"
If the SSH-server on 10.1.2.3 is configured to look for an authorized_keys file under the user's home directory, the file /home/myusername/.ssh/authorized_keys should contains, on a single line, the contents of the public key part (id_rsa.pub).
If you uploaded the corresponding private key part, and you specified on the command line where it it found, it should normally log you in without asking for a password. This tells you that your privatekey+publickey ssh authentication is working fine server-wise and for this keypair. This also tells you that the problem lies with the way the iApp tries to do it.
The iApp actually reads the field for the private key, which does not contain any newlines due to the field being a textbox and the private key being copied into it from your paste buffer. The iApp then puts newlines where needed, so the scp command has access to a "decent" private key file. It stores this under /config/, but it does so in encrypted format, using the F5 Unit Master Key as salt. You can decrypt this file as such, which should yield no error and give you a decent private key file:
sed -n '4,$p' /config/f5.automated_backup_scp.conf | openssl aes-256-ecb -salt -a -d -k $(f5mku -K)
Kind regards,
Thomas
daemon8814_1288Nimbostratus
How do you configure the SMB piece? What format does an AD username have to be in? What format does the file path have to be in? Thanks.- daemon8814_1288I am getting the following error on the during creation of the iApp:
01070712:3: Can't load node: 139 type: 2 - ltm/validation/MonitorRule.cpp, line 2114 - Dan_L1I've followed all the comments here trying to get this working; with running the sed -n command you put I get the output:
bad magic number
I can successfully ssh from the f5 > destination defining the id_rsa without a problem. When it tries to run it fails "permission denied"
Script (/Common/f5.automated_backup) generated this Tcl error:
script did not successfully complete: (bad decrypt
10933:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:330:
bad magic number
Any ideas? Thanks! - PatrickGThe iApp is very nice, but how can i use it in an redundant environment? The iApp configuration is synchronized between two nodes, means only one node performs an Backup
Woody_Thanks for this code. It worked in LTM training today (11.4) but errored out when I attempted to import it into our LTM (11.2.1). I'll be using this when I upgrade to 11.5.- mr_evil_116524Hi Thomas,
Can you pleas let me know how do I copy the content of the private key? Do I cat /root/.ssh/id_rsa from F5 CLI and paste that in iAPP GUI txtbox? or do I need to hardcore that somewhere else?
Please help, Thanks - lnxgeek
MVP
Hi Thomas
Great work with the iApp!
I think I found one "weakness" in the way you encryption (using openssl with the -a flag). If you have more than 30 characters in either username, path or server, it will break over two lines due to the base64 conversion. This will make the "sed" logic fail as it assumes the top three objects to be one-liners.
Maybe you could put in some marker in between them?
Regards
Thomas - lnxgeek@mr.evil - you're right, you just copy the id_rsa into the "private key" text box. The script logic takes care of the rest.
Regards
Thomas - lnxgeekI created an updated version of the iApp which handles longer than 30 characters strings.
For the time being it is only "SCP" that I modified.
Get it here:
http://download.domingo.dk/data/public/bc4c17.php
