Restic Backup for Linux

FreeNAS backup and replication

Lee Marzke
Backup Linux and FreeNAS

●
Two use cases in my office
– Backup of my Linux laptop home dir
– Backup of my FreeNAS storage
●
Static Files, ISO’s Templates, Archived VM’s
●
Active VM’s

These cover the majority of all my backup

2
Backup Linux and FreeNAS

●
Linux laptop backup (Ubuntu 16.04)
– Deja-Dup ( GUI included with Ubuntu )
●
Few options, no cloud targets
– Duplicity (cli)
●
Many targets, encryption(gpg), but no de-dup
– Restic (cli + api)
●
Many targets, encryption(aes-256), global de-dup
●
Streaming operation
●
~2x faster than duplicity

3
Backup Linux and FreeNAS

●
Linux laptop backup (Ubuntu 16.04)
– Statistics
●
Home Dir ( 200GB )
●
Backup initial ( ~3 hours, FIOS to S3 )
●
Backup incremental over public Wifi ~ 3min
– No VPN, no special ports, no mounted drives
●
S3 usage ~150GB

4
Backup Linux and FreeNAS

●
Restic Init repository
– Restic -r /path init
– Restic -r sftp:user@host/path init
– Export AWS_ACCESS_KEY_ID=xxxxxx
Export AWS_SECRET_ACCESS_KEY=yyyyyy
Restic -r s3:s3.amazonaws.com/bucket init

5
Backup Linux and FreeNAS

●
Restic sample commands
– restic backup
– restic snapshots ( list )
– restic check ( remote meta-data )
– restic find (file or dir)
– restic restore latest –target /restore \
–path /home/dir
– restic mount /mnt/restic (FUSE mount all
snaps)
6
Backup Linux and FreeNAS

●
Restic advantages on S3
– S3 has very restricted commands ( put, get )
no modification of existing ( disallows rsync )
– Restic essentially makes a remote filesystem
on S3 out of meta-data, and blobs
●
Meta-data (index, snapshots)
●
Blobs ( 1Mb to 8Mb encrypted files )
– Blob name is the sha256 hash of contents

7
Backup Linux and FreeNAS

●
Restic de-dup
– File Data cut into variable length 512k to 8Mb
chunks, then encrypted.
– File contents determines chunk ‘cut points’
●
Shift-resistant variable-size blocks implemented
with sliding window rolling-hash algorthim
●
Bit insertion/deletion doesn’t alter other block
checksums
●
Implemented with Rabin fingerprints ( sliding 64bit
window matches when lower x bits of checksum are
0 ( similar to algorithm used by rsync )
8
Backup Linux and FreeNAS

●
Restic Demo
– Written in Golang
– restic.net (download)
– rbackup script
http://plone.4aero.com/Members/lmarzke/talks/
restic/

9
FreeNAS backup and replication

●
FreeNAS ( freeBSD, ZFS NAS )
●
Stable open-source multi-protocol NAS for servers,
ESX, NFS shares, iSCSI, etc.
●
Best with many HD, SSD, >16G RAM
●
My lab/office NAS serves:
– VM’s, ISO, Plex DVR, Music, etc.
FreeNAS backup and replication

●
Previous FreeNAS talks
– Talk: ZFS and OpenStorage at PLUG, Oct 2011
– Howto: Building 10TB ZFS storage on Dell
2950, Apr 2014
●
This covers SmartOS , which was later replaced
on the same HW with FreeNAS
●
SmartOS and FreeNAS both boot from USB media
leaving all disks for storage.
– All talks at: plone.4aero.com

11
FreeNAS backup and replication

●
How to Backup FreeNAS ?
– Supported Options in FreeNAS v11.1U5
●
CloudSync to S3, Azure, GCP
●
ZFS send ( to another ZFS server )

– Cloud Sync great for:

– Cloud Sync not ideal for Running VM’s

●
How to Backup FreeNAS ?
– Option 1, Cloud Sync
●
S3, Azure, GCP, support via rclone
●
All changed files uploaded again.
●
Encryption support in 11.2 (rel 6/5/18 )

– Rclone
●
https://rclone.org/commands/rclone_sync/
●
Similar to rsync –delete
●
Compares modtime, size by default ( not checksum)
13
FreeNAS backup and replication

●
How to Backup FreeNAS ?
– Add s3 cloud sync
●
Push/Pull
●
Cred (key/secret)
●
Bucket
●
Folder
●
Local NAS path
●
Copy or Sync
(sync works like
rsync –delete )

14
FreeNAS backup and replication

S3 policy
"s3:ListBucket",
● "Action": [ "s3:GetAccelerateConfiguration",
"s3:PutAnalyticsConfiguration", "s3:GetBucketPolicy",
"s3:GetObjectVersionTagging", "s3:PutEncryptionConfiguration",
"s3:CreateBucket", "s3:GetEncryptionConfiguration",
– GUI needs two parts "s3:ReplicateObject",
"s3:GetObjectAcl",
"s3:GetObjectVersionTorrent",
"s3:AbortMultipartUpload",
"s3:DeleteBucketWebsite", "s3:PutBucketTagging",
"s3:PutLifecycleConfiguration", "s3:GetBucketRequestPayment",
– List all buckets "s3:GetObjectVersionAcl",
"s3:PutObjectTagging",
"s3:GetObjectTagging",
"s3:GetMetricsConfiguration",
"s3:DeleteObject", "s3:DeleteBucket",
– Bucket 4aeroBackup "s3:GetIpConfiguration",
"s3:DeleteObjectTagging",
"s3:PutBucketVersioning",
"s3:PutObjectAcl",
"s3:GetBucketWebsite", "s3:ListBucketMultipartUploads",
"s3:PutReplicationConfiguration",
Bucket itself "s3:PutMetricsConfiguration",
● "s3:DeleteObjectVersionTagging", "s3:PutObjectVersionTagging",
"s3:GetBucketNotification", "s3:GetBucketVersioning",
"s3:PutBucketCORS", "s3:GetBucketAcl",
●
contents of 1 folder only "s3:GetReplicationConfiguration",
"s3:ListMultipartUploadParts",
"s3:PutInventoryConfiguration",
"s3:PutIpConfiguration",
"s3:PutObject", "s3:GetObjectTorrent",
{ "s3:GetObject", "s3:PutBucketWebsite",
"Version": "2012-10-17", "s3:PutBucketNotification", "s3:PutBucketRequestPayment",
"Statement": [ "s3:PutBucketLogging", "s3:GetBucketCORS",
{ "s3:GetAnalyticsConfiguration", "s3:GetBucketLocation",
"Sid": "VisualEditor0", "s3:GetObjectVersionForReplication", "s3:ReplicateDelete",
"Effect": "Allow", "s3:GetLifecycleConfiguration", "s3:GetObjectVersion"
"Action": [ "s3:ListBucketByTags", ],
"s3:ListAllMyBuckets", "s3:GetInventoryConfiguration", "Resource": [
"s3:HeadBucket" "s3:GetBucketTagging", "arn:aws:s3:::4aeroBackup",
], "s3:PutAccelerateConfiguration", "arn:aws:s3:::4aeroBackup/FreeNAS/*"
"Resource": "*" "s3:DeleteObjectVersion", ]
}, "s3:GetBucketLogging", }
"s3:ListBucketVersions", ]
"s3:ReplicateTags", }
{ "s3:RestoreObject",
"Sid": "VisualEditor1",
"Effect": "Allow",

15
FreeNAS backup and replication

FreeNAS VM backup
– Option 2 - ZFS replication
– Binary incremental diff
●
snapshot to snapshot
– No FS traversal to find diffs !
– No checksum computations
– Optional VM quiesce before snapshot (vCenter)

16
FreeNAS backup and replication

●
FreeNAS ZFS replication
– Cloud provider ( Rsync.net )
– FreeBSD VM
●
1TB+
●
ssh access ( provide FreeNAS public ssh key )
●
For info google ( rsync + zfs )
– Use freeNAS GUI ssh public key
( not root’s ssh key )
– Remote Host key ( used for known_hosts entry)

17
FreeNAS backup and replication

●
Add Replication
– Remote vol/folder
– Compress = lz4
– Remote hostname
– Encrypt Cipher – fast
– Remote Hostkey
click “ssh key scan” to
populate

18
FreeNAS backup and replication

●
Rsync.net as backup target
– Public Instructions only for rsync, not ZFS.
– Google rsync + zfs for details
– Requires 1TB+ account
– Slightly more expensive than S3, but the only
efficient way to backup running VM’s to cloud.
– Arstecnica article link
– Rsync.net

19
Questions ?

20