Red Orbita
Home Linux & Systems Cybersecurity Cloud & DevOps Networks & Infrastructure SIEM & Monitoring DFIR & Threat Intel Development & Other All categories Projects About Tools

Installation and Configuration of BareOS in GNU/Linux

Leer en espanol
February 1, 2017 Linux & Systems rokitoh
Installation and Configuration of BareOS in GNU/Linux

Table of contents

BareOS (Backup Archiving Recovery Open Sourced) is an open source, cross-platform, enterprise-grade network backup solution. It was born as a Bacula fork when the d community ===

Introduction

BareOS (Backup Archiving Recovery Open Sourced) is an open source, cross-platform, enterprise-grade network backup solution. It was born as a Bacula fork when the community detected that the improvements and patches provided were only incorporated into the commercial version of Bacula.

BareOS is based on a client-server architecture with the following main components:

  • Director (bareos-dir)- Orchestrates all backup, restore and verification operations. It is the brain of the system.
  • Storage Daemon (bareos-sd)- Manages the storage devices where backup data is written (disk, tape, cloud).
  • File Daemon (bareos-fd)- The client agent that is installed on each machine to be backed up. Sends the data to the Storage Daemon.
  • Catalog (database)- Stores the index of all backed up files, volumes, and jobs. Supports MySQL/MariaDB and PostgreSQL.
  • Console (bconsole)- Command line interface to interact with the Director.
  • WebUI: web interface for management and monitoring.

In this guide we will cover the complete installation of BareOS server with MariaDB, installation of the client on GNU/Linux (Debian/Ubuntu and RHEL/CentOS) and in Windows, the configuration of the WebUI, and the execution of our first backup job.

Prerequisites

To follow this guide we need:

  • A GNU/Linux server (Debian 12 or RHEL 9 / Rocky Linux 9) for the Director, Storage Daemon and Catalog.
  • One or more GNU/Linux or Windows clients where to install the File Daemon.
  • Root or sudo access on all computers.
  • Network connectivity between the server and clients.

The ports that must be open on the firewall:

text
Puerto    Servicio          Dirección
------    ----------------  ---------------------------------
9101/tcp  Director          Clientes → Servidor
9102/tcp  File Daemon       Servidor → Clientes
9103/tcp  Storage Daemon    Clientes → Servidor
80/443    WebUI (Apache)    Navegador → Servidor

Installing BareOS Server

Add official repositories

BareOS maintains official repositories for major distributions. It is important to always use the official repositories to receive security updates.

On Debian/Ubuntu:

Bash
# Importar la clave GPG del repositorio
wget -qO- https://download.bareos.org/current/Debian_12/Release.key | \
  gpg --dearmor -o /usr/share/keyrings/bareos-archive-keyring.gpg

# Añadir el repositorio
echo "deb [signed-by=/usr/share/keyrings/bareos-archive-keyring.gpg] \
  https://download.bareos.org/current/Debian_12/ /" \
  > /etc/apt/sources.list.d/bareos.list

# Actualizar índices
apt update

On RHEL/Rocky/CentOS:

Bash
# Añadir el repositorio
wget -O /etc/yum.repos.d/bareos.repo \
  https://download.bareos.org/current/EL_9/bareos.repo

# Verificar que el repositorio se ha añadido correctamente
dnf repolist | grep bareos

Install server packages

On the server we install all the BareOS components along with the database and the WebUI.

On Debian/Ubuntu:

Bash
apt install -y bareos bareos-database-mysql mariadb-server \
  bareos-webui apache2 libapache2-mod-php php php-cli php-common

On RHEL/Rocky/CentOS:

Bash
dnf install -y bareos bareos-database-mysql mariadb-server \
  bareos-webui httpd php php-cli php-common

Database configuration

BareOS needs a database to store its catalog. Let's configure MariaDB and create the necessary tables.

First, we start and secure MariaDB:

Bash
systemctl enable --now mariadb
mysql_secure_installation

On Debian systems, we create the credentials file so that the BareOS scripts can connect to MariaDB:

ini
# /root/.my.cnf
[client]
host=localhost
user=root
password=TU_PASSWORD_MYSQL

We run the BareOS scripts to create the database, tables and assign privileges:

Bash
# Crear la base de datos
/usr/lib/bareos/scripts/create_bareos_database

# Crear las tablas del catálogo
/usr/lib/bareos/scripts/make_bareos_tables

# Asignar privilegios al usuario bareos
/usr/lib/bareos/scripts/grant_bareos_privileges

Starting server services

We enable and start the three main BareOS daemons and the web server:

Bash
# Habilitar e iniciar los servicios de BareOS
systemctl enable --now bareos-dir
systemctl enable --now bareos-sd
systemctl enable --now bareos-fd

# Habilitar e iniciar Apache (Debian) o httpd (RHEL)
systemctl enable --now apache2   # Debian/Ubuntu
# systemctl enable --now httpd   # RHEL/CentOS

We verify that everything is working correctly by connecting with bconsole:

Bash
bconsole

Connecting to Director localhost:9101
1000 OK: bareos-dir Version: 23.0.4 (01 January 2024)
Enter a period to cancel a command.
*status dir
...

If the connection is successful, the server is correctly configured.

WebUI Configuration

BareOS WebUI provides a graphical interface accessible from the browser to manage and monitor backups. We need to create a console user for the WebUI.

We edit or create the administration console configuration file:

Bash
cat /etc/bareos/bareos-dir.d/console/admin.conf

Console {
  Name = admin
  Password = "tu_password_segura"
  Profile = "webui-admin"
}

Reiniciamos el Director para aplicar los cambios:

Bash
systemctl restart bareos-dir

We access the WebUI from the browser in http://IP_SERVIDOR/bareos-webui and enter the configured credentials.

Installing the client on GNU/Linux

The File Daemon (bareos-fd) is the agent that is installed on each machine that we want to backup. Its installation is simple and light.

Add repositories on the client

On Debian/Ubuntu:

Bash
# Importar clave GPG
wget -qO- https://download.bareos.org/current/Debian_12/Release.key | \
  gpg --dearmor -o /usr/share/keyrings/bareos-archive-keyring.gpg

# Añadir repositorio
echo "deb [signed-by=/usr/share/keyrings/bareos-archive-keyring.gpg] \
  https://download.bareos.org/current/Debian_12/ /" \
  > /etc/apt/sources.list.d/bareos.list

apt update

On RHEL/Rocky/CentOS:

Bash
wget -O /etc/yum.repos.d/bareos.repo \
  https://download.bareos.org/current/EL_9/bareos.repo

Install and start the File Daemon

On Debian/Ubuntu:

Bash
apt install -y bareos-client
systemctl enable --now bareos-fd

On RHEL/Rocky/CentOS:

Bash
dnf install -y bareos-client
systemctl enable --now bareos-fd

Configure the client File Daemon

We edit the File Daemon configuration on the client. The key parameter is the Name which must match the client definition in the Director:

Bash
cat /etc/bareos/bareos-fd.d/client/myself.conf

Client {
  Name = cliente-linux-fd
  Maximum Concurrent Jobs = 20
}

cat /etc/bareos/bareos-fd.d/director/bareos-dir.conf

Director {
  Name = bareos-dir
  Password = "PASSWORD_COMPARTIDA_CON_DIRECTOR"
}

We restart the File Daemon to apply the changes:

Bash
systemctl restart bareos-fd

Installing the client on Windows

BareOS also supports Windows clients, allowing you to backup Windows servers and workstations from the same BareOS server.

Download and installation

We download the File Daemon installer for Windows from the official BareOS page:

text
https://download.bareos.org/current/windows/

The installer is an executable .exe standard. During the installation we will be asked for the following information:

  • Client Name: the name of the File Daemon (for example, cliente-windows-fd).
  • Director Name: the name of our Director (for example, bareos-dir).
  • Password- The password you will share with the Director to authenticate.
  • Director Address: the IP or hostname of the BareOS server.

Alternatively, we can install silently from the PowerShell command line:

Bash
.\bareos-fd-installer.exe /S /CLIENTNAME=cliente-windows-fd ^
  /DIRECTORNAME=bareos-dir /CLIENTPASSWORD=PASSWORD_SEGURA ^
  /DIRECTORADDRESS=192.168.1.100

Windows client configuration

The configuration files are located in C:\ProgramData\Bareos\. The structure is similar to that of Linux:

text
C:\ProgramData\Bareos\
├── bareos-fd.d\
│   ├── client\
│   │   └── myself.conf
│   └── director\
│       └── bareos-dir.conf
└── ...

We verify that the service is running from PowerShell:

Bash
Get-Service bareos-fd

Status   Name               DisplayName
------   ----               -----------
Running  bareos-fd          Bareos File Daemon

Register clients in the Director

Each client that we want to support must be registered in the Director. We create a configuration file for each client on the server.

For the Linux client:

Bash
cat /etc/bareos/bareos-dir.d/client/cliente-linux-fd.conf

Client {
  Name = cliente-linux-fd
  Address = 192.168.1.50
  Password = "PASSWORD_COMPARTIDA_CON_DIRECTOR"
  Catalog = MyCatalog
}

For Windows client:

Bash
cat /etc/bareos/bareos-dir.d/client/cliente-windows-fd.conf

Client {
  Name = cliente-windows-fd
  Address = 192.168.1.60
  Password = "PASSWORD_SEGURA"
  Catalog = MyCatalog
}

We reload the Director configuration:

Bash
systemctl reload bareos-dir

We verify the connection with clients from bconsole:

Bash
bconsole
*status client=cliente-linux-fd
*status client=cliente-windows-fd

If the response includes the File Daemon version, the connection is successful.

Create volumes and label media

Before running the first backup, we need to create and label a storage volume. Volumes are the containers where BareOS will write the data.

Bash
bconsole
*label
Automatically selected Catalog: MyCatalog
Using Catalog "MyCatalog"
Automatically selected Storage: File
Enter new Volume name: Full-Vol-001
Defined Pools:
     1: Scratch
     2: Incremental
     3: Full
     4: Differential
Select the Pool (1-4): 3
Connecting to Storage daemon File at bareOS:9103 ...
Sending label command for Volume "Full-Vol-001" Slot 0 ...
3000 OK label. VolBytes=204 Volume="Full-Vol-001" Device="FileStorage" (/var/lib/bareos/storage)
Catalog record for Volume "Full-Vol-001", Slot 0  successfully created.
Requesting to mount FileStorage ...
3906 File device "FileStorage" (/var/lib/bareos/storage) is always mounted.

We repeat the process to create volumes of the Incremental and Differential pools according to our backup strategy.

Configure and run the first backup job

BareOS includes a default job called DefaultJob that we can use as a template. To create a custom job for our Linux client, we create the following file:

Bash
cat /etc/bareos/bareos-dir.d/job/backup-cliente-linux.conf

Job {
  Name = "Backup-Cliente-Linux"
  JobDefs = "DefaultJob"
  Client = "cliente-linux-fd"
  Pool = Full
  FileSet = "LinuxAll"
  Schedule = "WeeklyCycle"
  Storage = File
  Messages = Standard
  Priority = 10
  Write Bootstrap = "/var/lib/bareos/%c.bsr"
}

We reload the configuration and execute the first backup manually from bconsole:

Bash
systemctl reload bareos-dir

bconsole
*run job=Backup-Cliente-Linux
Using Catalog "MyCatalog"
Run Backup job
JobName:  Backup-Cliente-Linux
Level:    Full
Client:   cliente-linux-fd
...
OK to run? (yes/mod/no): yes
Job queued. JobId=1

We can monitor the progress of the job with:

Bash
*status dir
*list jobs

File Restoration

Restoration is as important as backup. BareOS makes it easy to restore individual files or entire directories.

Bash
bconsole
*restore client=cliente-linux-fd
...
Select item (1-12): 5
# Opción 5: Select the most recent backup for a client

# Navegamos por el árbol de archivos
cwd is: /
$ cd /etc
$ mark nginx/
1 file marked.
$ done

# Se nos muestra un resumen del job de restauración
OK to run? (yes/mod/no): yes
Job queued. JobId=2

By default, files are restored to /tmp/bareos-restores/ on the client. We can change the destination route by modifying the option Where before confirming the job.

Useful bconsole commands

Below is a summary of the most used commands in bconsole for daily operation:

Bash
# Ver el estado general del Director
*status dir

# Ver el estado de un cliente específico
*status client=cliente-linux-fd

# Ver el estado del Storage Daemon
*status storage=File

# Listar todos los jobs ejecutados
*list jobs

# Listar los volúmenes disponibles
*list volumes

# Ejecutar un backup manualmente
*run job=Backup-Cliente-Linux level=Incremental

# Cancelar un job en ejecución
*cancel jobid=123

# Ver los mensajes pendientes
*messages

# Recargar la configuración sin reiniciar
*reload

Security considerations

For a safe deployment of BareOS in production, keep the following recommendations in mind:

  • Passwords- Change all default passwords immediately. Use strong and unique passwords for each component (Director, File Daemon, Storage Daemon, WebUI).
  • TLS- Enables TLS encryption on all communications between Director, Storage Daemon, and File Daemons. BareOS supports TLS natively since version 18.
  • Firewall- Restricts ports 9101, 9102 and 9103 to only the IPs of BareOS servers and clients.
  • WebUI- Configure HTTPS with a valid certificate (Let's Encrypt) and restrict access by IP if possible.
  • Storage: secures storage directory permissions (/var/lib/bareos/storage/) so that only the user bareos can read and write.
  • Offsite backups- Consider setting up a second Storage Daemon in a remote location or using the BareOS plugin for cloud (S3, Azure Blob).

:wq!

Comments