dovecot - Aug 2018 - Best practices for backing up small mailserver to remote location

My webserver also houses our mailserver. There's about six users on that
mail system and I'm thinking it would be good to back up the mailboxes to
my always on HTPC computer at home, which is reachable via a dynamic IP
service.

I know (or think) I need to use doveadm-backup for this but rather than
reinvent the wheel (or use the wrong wheel altogether) I'm wondering if
anyone can recommend a good tutorial or wiki entry that shows the best way
to loop through the users and send their backups to a remote server.

Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://dovecot.org/pipermail/dovecot/attachments/20180807/6d3e9e33/attachment.html>

On 08-08-2018 7:48, Ian Evans wrote:
> My webserver also houses our mailserver. There's about six users on
> that mail system and I'm thinking it would be good to back up the
> mailboxes to my always on HTPC computer at home, which is reachable
> via a dynamic IP service.
> 
> I know (or think) I need to use doveadm-backup for this but rather
> than reinvent the wheel (or use the wrong wheel altogether) I'm
> wondering if anyone can recommend a good tutorial or wiki entry that
> shows the best way to loop through the users and send their backups to
> a remote server.
Assuming you're running *nix on your HTPC and can install your own 
software on it a safe, secure and reliable way of doing it is:
- Since you're on dynamic IP at home, set up a VPN tunnel using the 
mailserver as server and HTPC as client. OpenVPN is ubiquitous and 
widely supported.
- rsync your mailboxes using the tunnel connection.
This way you can back up your entire server, not only the mailboxes.
You can add doveadm in the mix if you want, or use imapsync and so on 
and so forth.

YMMV

-- 
Adi Pircalabu

??????? Original Message ???????
On August 8, 2018 1:08 AM, Adi Pircalabu <adi at ddns.com.au> wrote:
> -   rsync
may not be the best option depending on the format of mailboxes. If you're
using maildir or maildir+ that's fine, but what about mbox or dbox ?

On 8/7/2018 5:08 PM, Adi Pircalabu wrote:
> - Since you're on dynamic IP at home, set up a VPN tunnel using the 
> mailserver as server and HTPC as client. OpenVPN is ubiquitous and 
> widely supported.
> - rsync your mailboxes using the tunnel connection.
> This way you can back up your entire server, not only the mailboxes.
Instead of openvpn, I use openssh. Use compression in the ssh tunnel, 
not the rsync connection, as rsync compression tends to be buggy and 
interrupts the download. I run sshd on a non-standard port to keep my 
logs relatively free of script kiddy noise from people looking for an 
ssh connection to crack. Run fail2ban to lock out the remaining script 
kiddies. Use a client certificate to log in with ssh unprompted, making 
it easy to download in a cron job.

Here's an example of scripting the download. Uncomment the DRYRUN line 
for testing, then comment for production. Add more rsync commands to 
back up different partitions. The --one-file-system prevents rsync from 
trying to back up /dev, /proc, and /sys. The --delete option will remove 
local files that were deleted on the remote server. Use that set of 
options once you're happy that the backup is working right.

#!/bin/sh
#set -e
set -x
#DRYRUN=--dry-run
#RSYNC_OPTIONS="$DRYRUN --one-file-system -avH --delete"
RSYNC_OPTIONS="$DRYRUN --one-file-system -avH"
DEST=/home/rsync/Server1

# Allow one hour so we don't burn up our bandwidth allowance
# from a command error

time timeout 1h \
rsync -e 'ssh -C -p 1234' $RSYNC_OPTIONS example.com:/ ${DEST}/ \
         --exclude tmp

# add more rsync commands here for other partitions