The old README was a flat list of one-line descriptions, several of
which no longer described the script: log_rotate gained flags and no
longer purges by default, restore and process_monitor now confirm before
acting, rsync_magic changed a default, and disk_cleanup grew guards.
Rewritten around the conventions that are now consistent across the
collection -- --dry-run, a confirmation before anything destructive, an
unattended escape hatch, and a refusal rather than a guess when there is
no tty to ask on. That last one is the part worth knowing before putting
any of these in cron.
Groups the scripts by what they are for rather than listing them
alphabetically, and states the things a reader would otherwise have to
discover by reading source: that security_audit as an ordinary user
proves very little, that log_rotate is not a logrotate replacement and
why, that update_system is unattended on every branch, and that
restore's tar options matter because an archive picks its own ownership
and modes.
Also updated three script headers that had gained ASSUME_YES/FORCE
escapes without documenting them, so the headers and the README agree.
Every flag, environment variable and behaviour claimed here was checked
against the scripts rather than written from memory.
backup.sh named archives with %Y%m%d, so a second run on the same day
silently overwrote the first -- destroying a good backup at the moment
someone was trying to take another. Names now carry seconds, and an
existing path is refused rather than clobbered. The archive is also
written to a .partial name and renamed only on success, with a trap to
clean up, so an interrupted run cannot leave a truncated file that looks
like a backup.
restore.sh extracted with tar's defaults. An archive is untrusted input
-- whoever produced it chooses the paths, ownership and modes inside it
-- and extracting as root let the tarball dictate uid/gid and restore
setuid bits directly. Now --no-same-owner --no-same-permissions, with -P
still absent so tar keeps stripping leading "/" and refusing ".."
members. It also lists what it is about to extract and confirms first,
since it silently overwrote whatever was already in the target.
Both scripts also gained set -euo pipefail, and both replaced the
`cmd; if [ $? -eq 0 ]` pattern with a direct `if cmd; then`, which is
what that idiom was reaching for and gets wrong as soon as any command
is inserted between the two lines.
Verified end to end: two same-second-apart backups both survive, no
.partial residue, restore refuses non-interactively, and the round trip
diffs identical.
jcoffey-dev
LINUXexpert.org