backuppc<\/code> by running the command below;<\/p>\n\n\n\napt install -y backuppc<\/pre>\n\n\n\nDuring the installation, you will be prompted to choose the web server to be used by BackupPC. Apache web server is used in this guide.<\/p>\n\n\n\n <\/figure>\n\n\n\nA default BackupPC administrative user, backuppc<\/code>, and its password is also created during the installation. This user is used to administer various tasks such as access to BackupPC web dashboard, carry out backups etc.<\/p>\n\n\n\n <\/figure>\n\n\n\nYou can choose to copy the password provided or you can proceed and reset the password later by executing the command below;<\/p>\n\n\n\n
htpasswd \/etc\/backuppc\/htpasswd backuppc<\/pre>\n\n\n\nConfiguring BackupPC Server on Debian 12<\/h3>\n\n\n\nDefine BackupPC Backup Protocol<\/h4>\n\n\n\n BackupPC uses different protocols to get backup data from devices being backed up:<\/p>\n\n\n\n
\nsmb<\/strong> \u2013 used for backing up windows machines<\/li>\n\n\n\ntar<\/strong> \u2013 used for backing up Linux\/Unix\/MacOSX systems<\/li>\n\n\n\nrsync<\/strong> \u2013 used for backing up Linux\/Unix\/MacOSX systems. This can also be used to backup Windows systems.<\/li>\n<\/ul>\n\n\n\nIn this tutorial we are going to configure BackupPC to use the rsync<\/strong> protocol as a backup method.<\/p>\n\n\n\nThus, change the line;<\/p>\n\n\n\n
$Conf{XferMethod} = 'smb';<\/code><\/pre>\n\n\n\nTo;<\/p>\n\n\n\n
$Conf{XferMethod} = 'rsync';<\/code><\/pre>\n\n\n\nUsing the command;<\/p>\n\n\n\n
sed -i '\/$Conf{XferMethod} =\/s\/smb\/rsync\/' \/etc\/backuppc\/config.pl<\/code><\/pre>\n\n\n\nThis is customizable per client system being backed up as well.<\/p>\n\n\n\n
Define BackupPC Backup User<\/h4>\n\n\n\n Also, by default, BackupPC is using root user to run backup tasks. However, in this guide, we are going to use a backuppc<\/code> user to execute backup tasks.<\/p>\n\n\n\nbackuppc<\/code><\/strong> user is created automatically during installation of BackupPC.<\/p>\n\n\n\nid backuppc<\/code><\/pre>\n\n\n\nuid=117(backuppc) gid=125(backuppc) groups=125(backuppc)<\/code><\/pre>\n\n\n\nIf you happen to change the backup user, edit BackupPC configuration file, \/etc\/backuppc\/config.pl<\/code> and replace the root<\/strong> user with a user you are using for backup under the Rsync\/Rsyncd Configuration.<\/strong> <\/p>\n\n\n\nsed '\/RsyncSshArgs\/s\/-l root\/-l backuppc\/' \/etc\/backuppc\/config.pl<\/code><\/pre>\n\n\n\nThe line should look like;<\/p>\n\n\n\n
$Conf{RsyncSshArgs} = ['-e', '$sshPath -l backuppc'];<\/code><\/pre>\n\n\n\nBackupPC uses htpasswd user files to restrict access to web interface. <\/p>\n\n\n\n
As such, you require a valid user in order to authenticate.<\/p>\n\n\n\n
The Web authentication user and its hashed credential password is stored under the \/etc\/backuppc\/htpasswd<\/code>.<\/p>\n\n\n\nThe password is generated during the installation. If you want, you can reset the password by running;<\/p>\n\n\n\n
htpasswd \/etc\/backuppc\/htpasswd backuppc<\/code><\/pre>\n\n\n\nAllow external access to BackupPC, which is set to only allow connections from localhost by default.<\/p>\n\n\n\n
sed -i 's\/local\/all granted\/' \/etc\/backuppc\/apache.conf<\/code><\/pre>\n\n\n\nThis is how the BackupPC Apache config file looks like without comment lines;<\/p>\n\n\n\n
cat \/etc\/backuppc\/apache.conf<\/code><\/pre>\n\n\n\n\nAlias \/backuppc \/usr\/share\/backuppc\/cgi-bin\/\n\n<Directory \/usr\/share\/backuppc\/cgi-bin\/>\n\tAllowOverride None\n\n # Uncomment the line below to ensure that nobody can sniff important\n # info from network traffic during editing of the BackupPC config or\n # when browsing\/restoring backups.\n # Requires that you have your webserver set up for SSL (https) access.\n #SSLRequireSSL\n\t\t\t\t\t\n\tOptions ExecCGI FollowSymlinks\n\tAddHandler cgi-script .cgi\n\tDirectoryIndex index.cgi\n\n AuthUserFile \/etc\/backuppc\/htpasswd\n\tAuthType basic\n\tAuthName \"BackupPC admin\"\n\n <RequireAll>\n\t\t# Comment out this line once you have setup HTTPS and uncommented SSLRequireSSL\n\t\tRequire all granted\n\n\t\t# This line ensures that only authenticated users may access your backups\n\t\tRequire valid-user\n\t<\/RequireAll>\n<\/Directory>\n<\/code><\/pre>\n\n\n\nNext, restart both backuppc and Apache service to apply the changes made above.<\/p>\n\n\n\n
systemctl restart backuppc apache2<\/pre>\n\n\n\nOpen Apache HTTP Server on Firewall<\/h4>\n\n\n\n If UFW is running, allow external access to Apache.<\/p>\n\n\n\n
ufw allow \"WWW Full\"<\/pre>\n\n\n\nAccessing BackupPC Web Interface<\/h4>\n\n\n\n You should now be able to access you via your server IP or resolvable domain name.<\/p>\n\n\n\n
http://IP-or-domain\/backuppc<\/code><\/pre>\n\n\n\nYou will be prompted to authenticate. Use the basic auth credentials created above.<\/p>\n\n\n\n <\/figure>\n\n\n\nGenerate Backup User SSH Keys<\/h4>\n\n\n\n For rsync to work, BackupPC requires passwordless SSH login for backuppc<\/strong> user to every client it will be getting backup data from.<\/p>\n\n\n\nThis also means that you should create a dedicated backuppc<\/code> user on the hosts you need to backup, at least using the rsync protocol.<\/p>\n\n\n\nAs a result, switch to backuppc user on BackupPC server and generate passwordless ssh keys and copy them to every host you want to backup.<\/p>\n\n\n\n
usermod -s \/bin\/bash backuppc<\/code><\/pre>\n\n\n\nsu - backuppc<\/pre>\n\n\n\nThis will opens up the sh shell. You can run bash command to launch bash shell.<\/p>\n\n\n\n
Generate SSH key pair by running the following command;<\/p>\n\n\n\n
ssh-keygen<\/code><\/pre>\n\n\n\n\nGenerating public\/private rsa key pair.\nEnter file in which to save the key (\/var\/lib\/backuppc\/.ssh\/id_rsa): \nCreated directory '\/var\/lib\/backuppc\/.ssh'.\nEnter passphrase (empty for no passphrase): \nEnter same passphrase again: \nYour identification has been saved in \/var\/lib\/backuppc\/.ssh\/id_rsa\nYour public key has been saved in \/var\/lib\/backuppc\/.ssh\/id_rsa.pub\nThe key fingerprint is:\nSHA256:Oe5pz3Yuo7cKcHSV5PfriLmHd7ae3V7bdtBPYgQEwu0 backuppc@bookworm\nThe key's randomart image is:\n+---[RSA 3072]----+\n| ..o++. |\n| .+o . |\n| . ... .. |\n| . . .E. .. |\n| . . S ... |\n| o . . +.o|\n| . . . ..+o|\n| o.o*o+oooO|\n| .=*BXo+==*|\n+----[SHA256]-----+\n<\/code><\/pre>\n\n\n\nCreate Backup User Account On Clients<\/h4>\n\n\n\n On Linux client servers you want to backup, login and create an account dedicated for backup purposes.<\/p>\n\n\n\n
For example, create a backuppc user account on remote client.<\/p>\n\n\n\n
useradd -m backuppc<\/pre>\n\n\n\npasswd backuppc<\/pre>\n\n\n\nCopy BackupPC Server SSH Keys to Backup Clients<\/h4>\n\n\n\n Now login backup to backuppc user on the BackupPC server and copy the SSH public key for backuppc user to backuppc user on the client. Copy the keys while logged as backuppc user.<\/strong><\/p>\n\n\n\nwhoami<\/code><\/pre>\n\n\n\nbackuppc<\/code><\/pre>\n\n\n\nssh-copy-id backuppc@192.168.43.214<\/pre>\n\n\n\n \nWhere 192.168.43.214 is my client IP address. Once you copy the key, you should be able to login without being prompted for a password.<\/li>\n<\/ul>\n\n\n\nNow, test the login to client with the backup user to ensure user can successfully login to client. You can use root user if you didn\u2019t make the changes above.<\/p>\n\n\n\n
su - backuppc<\/code><\/pre>\n\n\n\nssh -l backuppc client_IP whoami<\/code><\/pre>\n\n\n\nSample output;<\/p>\n\n\n\n
backuppc<\/code><\/pre>\n\n\n\nor<\/p>\n\n\n\n
ssh -l root client_IP whoami<\/code><\/pre>\n\n\n\nSample output<\/p>\n\n\n\n
root<\/code><\/pre>\n\n\n\nAllow Backup User to Run Rsync with Passwordless Sudo<\/h4>\n\n\n\n If you changed your backup user to non-root user on the BackupPC server, for example backuppc<\/code><\/strong> user in this case, then login to the client host as an administrative user and allow the non-user to run the rsync command without being prompted for password by adding the user to sudoers list. backuppc<\/code> user is used in this case.<\/p>\n\n\n\nssh user@client_IP<\/code><\/pre>\n\n\n\nRun the command below to find the absolute path of rsync.<\/p>\n\n\n\n
which rsync<\/pre>\n\n\n\nIf rsync command is not installed, run the following commands to install it.<\/p>\n\n\n\n
apt install rsync -y<\/code><\/pre>\n\n\n\nyum install rsync -y<\/code><\/pre>\n\n\n\nNext, update the sudoers file.<\/p>\n\n\n\n
echo \"backuppc ALL=NOPASSWD: \/usr\/bin\/rsync\" | sudo tee \/etc\/sudoers.d\/backuppc<\/code><\/pre>\n\n\n\nConfirm if there is any error with sudoers file;<\/p>\n\n\n\n
visudo -c -f \/etc\/sudoers<\/code><\/pre>\n\n\n\nSecure BackupPC Login on the Backup Client<\/h4>\n\n\n\n You may also want to disable ssh agent-forwarding, port-forwarding or even the pty for backuppc user logging in to the client from BackupPC.<\/p>\n\n\n\n
To do this, login to client, edit the ssh authorized key file and add the line below before the ssh-rsa<\/code> <\/strong>keyword.<\/p>\n\n\n\nfrom=\u201dbackuppc_server_ip\u201d,no-agent-forwarding,no-port-forwarding,no-pty<\/code><\/pre>\n\n\n\nReplace the backuppc_server_ip<\/code> with the IP address of the backuppc server.<\/p>\n\n\n\nvim \/home\/backuppc\/.ssh\/authorized_keys<\/pre>\n\n\n\nfrom=\"192.168.43.154\",no-agent-forwarding,no-port-forwarding,no-pty<\/strong> ssh-rsa AAAAB3NzaC1SSSc2EAAAADAQABAAABAQDYuDSNIPxQL6hNh6FeW4wj3hYJ+p42SD9BGVg5Rn6HuzIAi1zrU2pRceQ5VDRj5nXxSjs+oJJ4lXZ\/HTaUQDBFysVyIe9Sc4Z9Z5nmmmGWIJnKWfuvzSYbV2JbSJjcTfUPjH32DOvU+4PMdil\/4GjKW7pr8fyywl4XuhZMU6RfVw0LgzYuqzUQX5D6Q4MsgIN4HGqBsnVIBvSz2TcPc0hovtfKQMmUBQvp7L9Ob3AKuG01ZZznQ8Q6+eGL7EJHnS30h\/FLM8rKBxsvI6El8xog2E0\/ALnNGKWsg2NTEqWqQ3xpUDEnA6exgHEm+2xCuKAy1sAuSJHJHScUMLZIUE36t2+nB0Vn backuppc@backuppc.kifarunix-demo.com<\/code><\/pre>\n\n\n\nNext, you can also configure ssh logins to backuppc user accounts on clients hosts from the BackupPC server only. This can be done by editing sshd_config<\/code> file on the client and configuring as shown below;<\/p>\n\n\n\nsudo vim \/etc\/ssh\/sshd_config<\/pre>\n\n\n\nAdd the line below to SSHd configuration to allow login to the client as backuppc from the BackupPC server only.<\/p>\n\n\n\n
Match Host 192.168.43.154\n AllowUsers backuppc<\/code><\/pre>\n\n\n\nReload SSH configurations<\/p>\n\n\n\n
systemctl reload ssh<\/pre>\n\n\n\nAccessing BackupPC Web User Interface<\/h3>\n\n\n\n You can login as shown above.<\/p>\n\n\n\n
Backup Hosts using BackupPC<\/h3>\n\n\n\n If you noticed, the localhost, which is the server running backuppc is already added as one of the backup hosts.<\/p>\n\n\n\n
The backup tried to run but failed, due to some default backup protocol (tar) errors.<\/p>\n\n\n\n
Since we are using rsync as a backup protocol in this guide, you need to update this for the localhost backup to run.<\/p>\n\n\n\n
Hence, click on hostname (localhost for example)<\/strong> > edit config > Xfer<\/strong> > XferMethod > Rsync<\/strong>.<\/p>\n\n\n\n <\/figure>\n\n\n\nUpdate RsyncShareName<\/strong><\/p>\n\n\n\n <\/figure>\n\n\n\nClick Save<\/strong>.<\/p>\n\n\n\nReset the local account password for backuppc user.<\/p>\n\n\n\n
passwd backuppc<\/code><\/pre>\n\n\n\nKeep the password save.<\/p>\n\n\n\n
Install rsync and allow BackupPC user to execute rsync with sudo without password.<\/p>\n\n\n\n
apt install rsync<\/code><\/pre>\n\n\n\necho \"backuppc ALL=NOPASSWD: $(which rsync)\" | sudo tee \/etc\/sudoers.d\/backuppc<\/code><\/pre>\n\n\n\nsu - backuppc<\/code><\/pre>\n\n\n\nCopy the password generated above to server itself.<\/p>\n\n\n\n
ssh-copy-id backuppc@localhost<\/code><\/pre>\n\n\n\nInitiate localhost backup.<\/p>\n\n\n\n <\/figure>\n\n\n\nOnce the backup is running, you can see status under status menu.<\/p>\n\n\n\n <\/figure>\n\n\n\nYou can now add more hosts to backup.<\/p>\n\n\n\n
Update Global BackupPC Server Configurations<\/h3>\n\n\n\n You can update the general\/global configs of BackupPC by heading over to Edit Config<\/strong> under Server section on the left pane.<\/p>\n\n\n\n <\/figure>\n\n\n\nThat is basically it on our guide on how to installing BackupPC server on Debian 12.<\/p>\n\n\n\n
Backup Windows System via SMB Using BackupPC<\/a><\/p>\n\n\n\nBackup Windows System with BackupPC Using Rsyncd<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"In this guide, we will learn how to install BackupPC on Debian 12. BackupPC is a free, high-performance enterprise-grade backup software suite with a web-based frontend that<\/p>\n","protected":false},"author":10,"featured_media":17300,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[39,907,121],"tags":[6905,89,6906,6904,6903],"class_list":["post-17278","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-storage","category-backuppc","category-howtos","tag-backup-server-using-backuppc","tag-backuppc","tag-backuppc-backup-server","tag-debian-12-backuppc","tag-install-backuppc-debian-12","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/17278"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=17278"}],"version-history":[{"count":5,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/17278\/revisions"}],"predecessor-version":[{"id":20774,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/17278\/revisions\/20774"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/17300"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=17278"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=17278"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=17278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}