dovecot - Aug 2018 - Best practices for backing up small mailserver to remote location

On 8/7/2018 5:08 PM, Adi Pircalabu wrote:
> - Since you're on dynamic IP at home, set up a VPN tunnel using the 
> mailserver as server and HTPC as client. OpenVPN is ubiquitous and 
> widely supported.
> - rsync your mailboxes using the tunnel connection.
> This way you can back up your entire server, not only the mailboxes.
Instead of openvpn, I use openssh. Use compression in the ssh tunnel, 
not the rsync connection, as rsync compression tends to be buggy and 
interrupts the download. I run sshd on a non-standard port to keep my 
logs relatively free of script kiddy noise from people looking for an 
ssh connection to crack. Run fail2ban to lock out the remaining script 
kiddies. Use a client certificate to log in with ssh unprompted, making 
it easy to download in a cron job.

Here's an example of scripting the download. Uncomment the DRYRUN line 
for testing, then comment for production. Add more rsync commands to 
back up different partitions. The --one-file-system prevents rsync from 
trying to back up /dev, /proc, and /sys. The --delete option will remove 
local files that were deleted on the remote server. Use that set of 
options once you're happy that the backup is working right.

#!/bin/sh
#set -e
set -x
#DRYRUN=--dry-run
#RSYNC_OPTIONS="$DRYRUN --one-file-system -avH --delete"
RSYNC_OPTIONS="$DRYRUN --one-file-system -avH"
DEST=/home/rsync/Server1

# Allow one hour so we don't burn up our bandwidth allowance
# from a command error

time timeout 1h \
rsync -e 'ssh -C -p 1234' $RSYNC_OPTIONS example.com:/ ${DEST}/ \
         --exclude tmp

# add more rsync commands here for other partitions

On 09-08-2018 10:05, Kenneth Porter wrote:
> On 8/7/2018 5:08 PM, Adi Pircalabu wrote:
>> - Since you're on dynamic IP at home, set up a VPN tunnel using the
>> mailserver as server and HTPC as client. OpenVPN is ubiquitous and 
>> widely supported.
>> - rsync your mailboxes using the tunnel connection.
>> This way you can back up your entire server, not only the mailboxes.
> 
> Instead of openvpn, I use openssh. Use compression in the ssh tunnel,
> not the rsync connection, as rsync compression tends to be buggy and
> interrupts the download. I run sshd on a non-standard port to keep my
> logs relatively free of script kiddy noise from people looking for an
> ssh connection to crack. Run fail2ban to lock out the remaining script
> kiddies. Use a client certificate to log in with ssh unprompted,
> making it easy to download in a cron job.
There's more than one way to skin a cat :) Moving the ssh port and 
adding fail2ban in the mix is another option. Personally tend to use VPN 
tunnels for dynamic IP clients for various reasons, such as being able 
to lock clients out by revoking keys.

-- 
Adi Pircalabu

On 2018.08.09. 3:21, Adi Pircalabu wrote:
> On 09-08-2018 10:05, Kenneth Porter wrote:
>> On 8/7/2018 5:08 PM, Adi Pircalabu wrote:
>>> - Since you're on dynamic IP at home, set up a VPN tunnel using
the
>>> mailserver as server and HTPC as client. OpenVPN is ubiquitous and 
>>> widely supported.
>>> - rsync your mailboxes using the tunnel connection.
>>> This way you can back up your entire server, not only the
mailboxes.
>>
>> Instead of openvpn, I use openssh. Use compression in the ssh tunnel,
>> not the rsync connection, as rsync compression tends to be buggy and
>> interrupts the download. I run sshd on a non-standard port to keep my
>> logs relatively free of script kiddy noise from people looking for an
>> ssh connection to crack. Run fail2ban to lock out the remaining script
>> kiddies. Use a client certificate to log in with ssh unprompted,
>> making it easy to download in a cron job.
> 
> There's more than one way to skin a cat :) Moving the ssh port and 
> adding fail2ban in the mix is another option. Personally tend to use VPN 
> tunnels for dynamic IP clients for various reasons, such as being able 
> to lock clients out by revoking keys.
> 
I prefer connecting from backup server side (and this will resolve 
dynamic ip problem in this case), so backups are not accessible from 
production servers.
Another option is rsnapshot (if you need versions), it's rsync over ssh 
and depending on hard link "magic" it conserves disk space (only one 
copy of mail, independently how long history you have). But as said 
before - it better works for maildir.

--
KSB