tech stuff and things
Automated Drupal Web Site Backups Using Drush and Amazon's S3 Storage (TAR & RSYNC options included).
Written by Chris Borkowski    Friday, 30 December 2011 14:38    PDF Print E-mail
Backup Backup Backup - And Test Restores

Image via Wikipedia

** 12/31/11 NOTE ** I've added RSYNC COMMANDS into the script for people who don't use Amazon's S3 storage and services. In order to automate this part of the script you'll have to set up pairs of RSA host keys in order to for this part to run without passwords.  See How To Setup RSA Hostkeys.

Here's a script that I've been tinkering with, perfecting, and tweaking over the last few months. The scenario is this :

The company I work for has some 30 production sites and some 40 development sites that we work with daily. We use Amazon's EC2 hosting for the sites we need rock-solid-brute-force high-level-computing. For lesser trafficked sites we use Linode hosting at a much lower cost. Each of these hosting services offer snapshots and backup services, but each differs greatly in what type of snapshot or backup is run. Amazon EC2 is a whole universe unto itself and takes sometime to figure out their EC2/S3 work-flow. None the less, we felt it necessary to have a secondary backup routine where the various individual site were backup'ed individually and could be restored within seconds rather than sifting through a huge all-in-one archive.

Solution: Use Drush (Drupal Command Line tool), php (to take advantage of the S3 API) and good old fashion UNIX commands to get the job done.

Drush is sexy

Image by gallivant via Flickr

Drush was a late addition to this script as I noticed that doing a simple "mysqldump" created some unwieldy SQL files that had unnecessary data in the Drupal cache tables. I could write a complex mysql drop routine, but Drush does it in one command. Also, I'm using the unix split command to bust up the large tar files that Drush creates using "archive-site" into 1 gig chunks in order to overcome S3's 2 gig file limit on versions of < PHP 5.3. I originally used a simple tar command, but switched to Drush for the sake of continuity. At the end of this post I'll offer some simple commands to restore the backups rather quickly.

Hypothetically you'll need a directory structure like this to run this type of script

/path/backup

/path/backup/backups

Make sure you have read/write permissions to the directories. "backups" is a working directory where all sql and tar files will live temporarily before uploading to S3.

So here's the srcipt with notes.

<?php
/*
*- 12/29/11
*- this is the current inventory of sites we'll be backing up
*- INSTANCE: ec2-75-101-158-168.compute-1.amazonaws.com
*- old.balboapark.org
*- slam this in your /etc/crontab file to run at 1am everynight
*- 1 1 * * * php /root/backup/drush-test-backup.php
*/


//adjust to your path
$firstdir = getcwd();
chdir('/ebsvol/apache/www/backup');

// get this from Amazon. it has all the S3 classes you'll need . adjust to your path.
include ('/ebsvol/apache/www/backup/S3.php');

// real simple - create a file for each day and a weekly file for the end of the week
$thedate = getdate();
if ($thedate["wday"] == "0") {
$datestr = date('ymd');
} else {
$datestr = date('D');
}

// old.balboapark.org
//using drush to clear all caches. makes your drupal site DB all nice and clean and compact.

$backupfile = 'drush-old-balboapark-org-backup-' . $datestr . '.sql.gz';
chdir('/ebsvol/apache/www/old.balboapark.org');
$syscmd = 'drush cc all';
system($syscmd);
chdir('/ebsvol/apache/www/backup');
$syscmd = 'mysqldump -uUSERNAME -pYOURPASS balboapark | gzip -c > backups/' . $backupfile;
printf("Creating %s...\n", $backupfile);
system($syscmd);
printf("Copying %s to S3 bucket...\n", $backupfile);

//rsync section - uncomment and use this part if you dont use S3 and have set up RSA hostkeys on both servers.
//$host = 'your.domain.com';
//$dest = '/path/to/your/destination';
//$rsync_user = 'username';  // depentant on hostkeys in ~.ssh/
//$syscmd = rsync -vrup backups/'.$backupfile.  ' '. $rsync_user. '@'. $host. $dest;
//printf("Sending %s to %s ...\n", $backupfile, $host);
//system($syscmd);

// comment out if using RSYNC

s3copy('backups', 'bpoc-backups');
$syscmd = 'rm -f backups/' . $backupfile;
printf("Deleting %s...\n", $backupfile);
system($syscmd);

//taring without drush
//$syscmd = 'tar czPf backups/' . $backupfile . ' /ebsvol/apache/www/old.balbopark.org';
//printf("Creating %s...\n", $backupfile);

//drush site backup. you actually need to be in your site directory to work. drush utilizes /sites/default/settings.php to run
chdir('/ebsvol/apache/www/old.balboapark.org');
$backupfile = 'drush-old-balboapark-org-backup-' . $datestr . '.tar.gz';
$syscmd = 'drush archive-dump --destination=/ebsvol/apache/www/backup/backups/' . $backupfile;
printf("Creating %s...\n", $backupfile);
system($syscmd);

//split into 1 gig chunks - S3 has a 2 gig file transfer limit/bug for < versions of PHP 5.3
chdir('/ebsvol/apache/www/backup');
$dr = '/ebsvol/apache/www/backup/backups/';
printf("Spliting %s into 1 gig chunks...\n", $backupfile);
$syscmd = 'split -b 1024m ' . $dr . $backupfile . ' ' . $dr . $backupfile . '.part-';
system($syscmd);
//dump orignial tar file
$syscmd = 'rm -f backups/' . $backupfile;
system($syscmd);

//rsync section - USING WILD CARD ! uncomment and use this part if you dont use S3 and have set up RSA hostkeys on both servers.
//$host = 'your.domain.com';
//$dest = '/path/to/your/destination';
//$rsync_user = 'username';  // depentant on hostkeys in ~.ssh/
//$syscmd = rsync -vrup backups/* '. $rsync_user. '@'. $host. $dest;
//printf("Sending %s to %s ...\n", $backupfile, $host);
//system($syscmd);

//comment out if using RSYNC
printf("Copying %s to S3 bucket...\n", $backupfile);
s3copy('backups', 'bpoc-backups');

//cleanup everything else
$syscmd = 'rm -f backups/*';
printf("Deleting %s...\n", $backupfile);
system($syscmd);

//simple mail notification
mail(" This e-mail address is being protected from spambots. You need JavaScript enabled to view it ", "The drush test backup for ec2-75-101-158-168.compute-1.amazonaws.com was run", "The backup ran. Please verify the files are in the S3bucket");

chdir($firstdir);
return;

//S3 roll your own function

function s3copy($targetdir, $bucket) {

//switch directories to target directory
$origdir = getcwd();
chdir($targetdir);

//instantiate S3 class using secret S3 KEYS
$s3 = new S3('XXXXXXXXXXX', 'XXXXXXXXXXX');

//try to the bucket
$okay = $s3 -> putBucket($bucket, S3::ACL_PUBLIC_READ);

if ($okay) {
//  echo "Created bucket ". $bucket ."\n";
} else {
die("Can't create bucket " . $bucket . "\n");
}

//iterate through files in the directory
if ($handle = opendir('.')) {
while (false !== ($filename = readdir($handle))) {
if ($filename != "." && $filename != "..") {
if ($okay) {
if ($s3 -> putObjectFile($filename, $bucket, basename($filename), S3::ACL_PUBLIC_READ)) {
echo "File copied: " . basename($filename) . "\n";
} else {
echo "*** Failed to copy: " . basename($filename) . "\n";
}
} else {
}
}
}
closedir($handle);
}
chdir($origdir);
}
?>

So now what ? How to I use the backup files ? By now you should have some GUI for S3 sotrage. Firefox has a nice S3 organizer that well allow uploads and downloads.

1) Create a new directory to restore your files to and place your backup files there.

2) navigate your way to said directory and issue the following commands:

a) to rejoin the split tar files open your terminal and do something like this:

bpoc-cjb-mac:Desktop cborkowski$ mkdir reassemble-test
bpoc-cjb-mac:Desktop cborkowski$ mv drush-* reassemble-test/

bpoc-cjb-mac:reassemble-test cborkowski$ ls
drush-old-balboapark-org-backup-Thu.sql.gz
drush-old-balboapark-org-backup-Thu.tar.gz.part-aa
drush-old-balboapark-org-backup-Thu.tar.gz.part-ab

bpoc-cjb-mac:Desktop cborkowski$ cd reassemble-test/
bpoc-cjb-mac:reassemble-test cborkowski$ cat drush-old-balboapark-org-backup-Thu.tar.gz.part* > drush-old-balboapark-org-backup-Thu.tar.gz.
.......... working......
bpoc-cjb-mac:reassemble-test cborkowski$ ls
drush-old-balboapark-org-backup-Thu.sql.gz
drush-old-balboapark-org-backup-Thu.tar.gz
drush-old-balboapark-org-backup-Thu.tar.gz.part-aa
drush-old-balboapark-org-backup-Thu.tar.gz.part-ab

//untar the newly joined file
bpoc-cjb-mac:reassemble-test cborkowski$ tar -xvf drush-old-balboapark-org-backup-Thu.tar.gz

b) to untar and restore your DB

bpoc-cjb-mac:reassemble-test cborkowski$ tar -xvf drush-old-balboapark-org-backup-Thu.sql.gz

//make sure you have a DB and privleges to restore
bpoc-cjb-mac:reassemble-test cborkowski$ mysql -uUSERNAME -pPASSWD databasename  < drush-old-balboapark-org-backup-Thu.sql

Bingo ! you now have all the files and a fresh DB to work with. Perhaps you might want to add a new Apache virtual host to test the restore or perhaps you just want to overwrite existing fies in your web root. If you made it this far I'll leave that up to you.

 

Enhanced by Zemanta


Add this article to your favorite Social Bookmarking websites
Reddit! Del.icio.us! JoomlaVote! Google! Live! Facebook! StumbleUpon! Yahoo! Free social bookmarking plugins and extensions for Joomla! websites!
Last Updated ( Saturday, 31 December 2011 15:40 )
 
A quick how to: Linux Firewalls
Written by Chris Borkowski    Tuesday, 16 March 2010 15:58    PDF Print E-mail

Here's a very brief how to configure your linux software firewall to keep the bad guys out. You'll need root access to your server to perform these actions.

First log in to your server and become root by issuing the "su" command.

Take a look at your logs in /var/log/secure to see who's been trying to get into your server. Issue the following command via a shell

[root@aux cborkowski]# tail /var/log/secure

or

[root@aux cborkowski]# less /var/log/secure

The output will show something like this if there has been failed log in attempts :

Mar 14 16:09:12 aux sshd[10222]: Failed password for root from 24.147.232.255 port 39077 ssh2
Mar 14 16:09:12 aux sshd[10223]: Received disconnect from 24.147.232.255: 11: Bye Bye
d=0 tty=ssh ruser= rhost=c-24-147-232-255.hsd1.ma.comcast.net user=root
Mar 14 16:09:24 aux sshd[10237]: Failed password for root from 24.147.232.255 port 39349 ssh2
Mar 14 16:09:24 aux sshd[10238]: Connection closed by 24.147.232.255
Mar 14 16:12:55 aux sshd[10412]: Invalid user nf3ct from 24.147.232.255
Mar 14 16:12:55 aux sshd[10413]: input_userauth_request: invalid user nf3ct

Clearly someone or something from the ip adresss 24.147.232.255 is trying to get into your server.

You may want to try to find out more about this address. The whois and traceroute commands will give you a bit of information about the IP address.

Issue the folowing command:

[root@aux cborkowski]# whois 24.147.232.255
[Querying whois.arin.net]
[whois.arin.net]
Comcast Cable Communications Holdings, Inc RW2-NORTHEAST-4 (NET-24-147-0-0-1)
24.147.0.0 - 24.147.255.255
Comcast Cable Communications Holdings, Inc NEW-ENGLAND-11 (NET-24-147-128-0-1)
24.147.128.0 - 24.147.255.255

# ARIN WHOIS database, last updated 2010-03-15 20:00
# Enter ? for additional hints on searching ARIN's WHOIS database.
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at https://www.arin.net/whois_tou.html

Now try the traceroute command:

[root@aux cborkowski]# traceroute 24.147.232.255

traceroute to 24.147.232.255 (24.147.232.255), 30 hops max, 40 byte packets
1 192.168.1.205 (192.168.1.205) 2.559 ms 2.845 ms 3.083 ms
2 192.168.1.36 (192.168.1.36) 1.940 ms 2.004 ms 2.059 ms
3 63.116.182.1 (63.116.182.1) 3.090 ms * *
4 500.MFR425.GW16.NYC9.ALTER.NET (65.194.77.129) 662.010 ms 662.004 ms 662.016 ms
5 0.ge-3-0-0.XT1.NYC9.ALTER.NET (152.63.22.138) 662.052 ms 662.045 ms 662.033 ms

This will give you some idea about who or what is trying to log in to your server. If you deem that login attempt as suspicious it's time to take some action and shut that IP down for good.

Here's some command to issue to get a basic deny rule in place and running on your software firewall. (The paths may differ depending on your flavor build of linx). In this example I am using Red Hat Enterprise Linux 5.

Adding a firewall rule for a single address.

[root@aux cborkowski]# /sbin/iptables -A INPUT -s 24.147.232.255 -j DROP

Adding a firewall rule for a whole subnet range of IP's

[root@aux cborkowski]# /sbin/iptables -A INPUT -s 24.147.232.0/24 -j DROP

Once you added the rule you'll then want to commit the rule to the config file. Issue the following to save the rule:

[root@aux cborkowski]#/sbin/service iptables save

Now that the rule is in place it's time to fire up the software firewall. Issue the following command:

[root@aux cborkowski]# /etc/init.d/iptables start

You now have a software fire wall running. Check the status of your firewall by issuing the following command:

[root@aux init.d]# /etc/init.d/iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 DROP all -- 202.199.158.0/24 0.0.0.0/0
2 DROP all -- 219.147.173.0/24 0.0.0.0/0
3 DROP all -- 83.242.228.0/24 0.0.0.0/0
4 DROP all -- 202.113.16.0/24 0.0.0.0/0
5 DROP all -- 24.186.183.0/24 0.0.0.0/0
6 DROP all -- 62.212.67.0/24 0.0.0.0/0

Chain FORWARD (policy ACCEPT)
num target prot opt source destination

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

Table: mangle
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination

Chain INPUT (policy ACCEPT)
num target prot opt source destination

Chain FORWARD (policy ACCEPT)
num target prot opt source destination

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination

Table: nat
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

 

There you go ! Repeat the steps to add more IP's if you see suspicious activity in your logs.

It always helps to read the documentation on iptables. So it would be wise to read the documentation. You can call up the manual by issuing the following


[root@aux init.d]# man iptables

Read more here:

http://www.linuxtopia.org/online_books/rhel5/rhel5_administration/rhel5_ch-iptables.htm


Enhanced by Zemanta


Add this article to your favorite Social Bookmarking websites
Reddit! Del.icio.us! JoomlaVote! Google! Live! Facebook! StumbleUpon! Yahoo! Free social bookmarking plugins and extensions for Joomla! websites!
Last Updated ( Saturday, 06 November 2010 23:01 )
 
Google Docs Joomla Blog Test
Written by Chris Borkowski    Saturday, 24 October 2009 05:03    PDF Print E-mail
Google Docs Joomla Blog Test

Just a simple test to publish to Joomla's XMLRPC method

Here's the share setting for Google docs to publish to Joomla.
Make sure the XMLRPC MoveableType Plugin is enable.
By default this will publish to the Section & Category ID #1.



Hey here's a image from my super cool Skitch account.


Here's some stuff the zemanta plugin found:

 

Joomla!

Image via Wikipedia

That's the Joomla logo the Zementa plug-in found.

You can mash things up pretty fast with said plug-in.

Enhanced by Zemanta


Add this article to your favorite Social Bookmarking websites
Reddit! Del.icio.us! JoomlaVote! Google! Live! Facebook! StumbleUpon! Yahoo! Free social bookmarking plugins and extensions for Joomla! websites!
Last Updated ( Saturday, 06 November 2010 23:02 )
 
flip-text javascript
Written by Administrator    Tuesday, 11 November 2008 18:37    PDF Print E-mail
Here's a tiny javascriptjavascript is cool, but this is just a simple CSS tooltip. that will flip your junk. The upside-down text can be pasted in to Facebook too.

Original:

Flipped:



Add this article to your favorite Social Bookmarking websites
Reddit! Del.icio.us! JoomlaVote! Google! Live! Facebook! StumbleUpon! Yahoo! Free social bookmarking plugins and extensions for Joomla! websites!
Last Updated ( Monday, 12 October 2009 06:34 )
 
  • «
  •  Start 
  •  Prev 
  •  1 
  •  2 
  •  3 
  •  4 
  •  Next 
  •  End 
  • »


Page 1 of 4

Your are currently browsing this site with Internet Explorer 6 (IE6).

Your current web browser must be updated to version 7 of Internet Explorer (IE7) to take advantage of all of template's capabilities.

Why should I upgrade to Internet Explorer 7? Microsoft has redesigned Internet Explorer from the ground up, with better security, new capabilities, and a whole new interface. Many changes resulted from the feedback of millions of users who tested prerelease versions of the new browser. The most compelling reason to upgrade is the improved security. The Internet of today is not the Internet of five years ago. There are dangers that simply didn't exist back in 2001, when Internet Explorer 6 was released to the world. Internet Explorer 7 makes surfing the web fundamentally safer by offering greater protection against viruses, spyware, and other online risks.

Get free downloads for Internet Explorer 7, including recommended updates as they become available. To download Internet Explorer 7 in the language of your choice, please visit the Internet Explorer 7 worldwide page.