| 1 | <?xml version="1.0" encoding="iso-8859-1"?> |
|---|
| 2 | <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> |
|---|
| 3 | <html xmlns="http://www.w3.org/1999/xhtml"> |
|---|
| 4 | <head> |
|---|
| 5 | <meta http-equiv="content-type" content="text/html;charset=iso-8859-1" /> |
|---|
| 6 | <title>Box Backup certificates and accounts</title> |
|---|
| 7 | <link rel="stylesheet" href="bbstyles.css" type="text/css" /> |
|---|
| 8 | </head> |
|---|
| 9 | <body> |
|---|
| 10 | <div align="center"> |
|---|
| 11 | <div id="header"> |
|---|
| 12 | <div id="logo"> |
|---|
| 13 | <img src="images/bblogo.png" alt="logo" height="65" width="331" border="0" vspace="5" align="middle" /> <img src="images/stepahead.png" alt="a step ahead in data security" width="182" height="11" hspace="10" vspace="20" border="0" align="middle" /></div> |
|---|
| 14 | </div> |
|---|
| 15 | <div id="page"> |
|---|
| 16 | |
|---|
| 17 | |
|---|
| 18 | <h1>Box Backup certificates and accounts</h1> |
|---|
| 19 | |
|---|
| 20 | <p>There are two steps involved to create an account. You need to create the account on the |
|---|
| 21 | server, and sign a certificate to give the client permission to connect to the server.</p> |
|---|
| 22 | |
|---|
| 23 | <p>Running a Certification Authority for TLS (SSL) connections is not trivial. However, |
|---|
| 24 | I have written a script to do most of the work in a way which is good enough for most |
|---|
| 25 | deployments.</p> |
|---|
| 26 | |
|---|
| 27 | <h2>Warning about clock times</h2> |
|---|
| 28 | |
|---|
| 29 | <p>SSL certificates contain validity dates, including a "valid from" time. If the clock on the |
|---|
| 30 | machine which signs the certificates is not syncronised to the clocks of the machines using these |
|---|
| 31 | certificates, you will probably get strange errors until the start time is reached on all |
|---|
| 32 | machines.</p> |
|---|
| 33 | |
|---|
| 34 | <p>If you get strange errors when attempting to use new certificates, check the clocks! You will |
|---|
| 35 | probably just need to wait a while until the certificates become valid, rather than having to |
|---|
| 36 | regenerate them.</p> |
|---|
| 37 | |
|---|
| 38 | <h2>Set up CA</h2> |
|---|
| 39 | |
|---|
| 40 | <p>It's best to do this on a machine other than your server, probably without direct network access. |
|---|
| 41 | The contents of this directory control who can access your backup store server.</p> |
|---|
| 42 | |
|---|
| 43 | <p>To setup the basic key structure, do</p> |
|---|
| 44 | |
|---|
| 45 | <pre> |
|---|
| 46 | /usr/local/bin/bbstored-certs ca init |
|---|
| 47 | </pre> |
|---|
| 48 | |
|---|
| 49 | <p>(See <a href="openssl.html">OpenSSL notes</a> if you get an OpenSSL error)</p> |
|---|
| 50 | |
|---|
| 51 | <p>This creates the directory 'ca' in the current directory, and initialises it with basic keys.</p> |
|---|
| 52 | |
|---|
| 53 | <h2>Sign a server certificate</h2> |
|---|
| 54 | |
|---|
| 55 | <p>When you use the <tt>bbstored-config</tt> script to set up a config file for a server, it will |
|---|
| 56 | generate a certificate request (CSR) for you. Transfer it to the machine with your CA, then do</p> |
|---|
| 57 | |
|---|
| 58 | <pre> |
|---|
| 59 | /usr/local/bin/bbstored-certs ca sign-server hostname-csr.pem |
|---|
| 60 | </pre> |
|---|
| 61 | |
|---|
| 62 | <p>which signs the certificate for the server. Follow the instructions in the output on which files to install |
|---|
| 63 | on the server. The CSR file is now no longer needed. Make sure you run this command from the directory above |
|---|
| 64 | the directory 'ca'.</p> |
|---|
| 65 | |
|---|
| 66 | <h2>Setting up an account.</h2> |
|---|
| 67 | |
|---|
| 68 | <p>Choose an account number for the user. This must be unique on the server, and is presented as a 31 bit |
|---|
| 69 | number in hex greater than 0, for example, 1 or 75AB23C. Then on the backup store server, create the account |
|---|
| 70 | with</p> |
|---|
| 71 | |
|---|
| 72 | <pre> |
|---|
| 73 | /usr/local/bin/bbstoreaccounts create 75AB23C 0 4096M 4505M |
|---|
| 74 | </pre> |
|---|
| 75 | |
|---|
| 76 | <p>This looks complicated. The numbers are, in order...</p> |
|---|
| 77 | <ul> |
|---|
| 78 | <li>The account number allocated (hex) |
|---|
| 79 | <li>The RAID disc set (0 if you use raidfile-config and don't add a new set) |
|---|
| 80 | <li>Soft limit (size) |
|---|
| 81 | <li>Hard limit (size) |
|---|
| 82 | </ul> |
|---|
| 83 | |
|---|
| 84 | <p>The sizes are are specified in Mb, Gb, or blocks, depending on the suffix. <tt>1M</tt> specifies 1 Mb, |
|---|
| 85 | <tt>1G</tt> specifies 1 Gb, and <tt>1B</tt> specifies 1 block, the size of which depends on how you have |
|---|
| 86 | configured the raidfile system with <tt>raidfile-config</tt>.</p> |
|---|
| 87 | |
|---|
| 88 | <p>In this example, I have allocated 4Gb (assuming you use 2048 byte blocks as per my example) as the soft limit, |
|---|
| 89 | and 4Gb + 10% as the hard limit.</p> |
|---|
| 90 | |
|---|
| 91 | <p><b>NOTE</b> The sizes specified here are pre-RAID. So if you are using userland RAID, you are |
|---|
| 92 | actually allocating two-thirds of this amount. This means that, when you take compression into account, that |
|---|
| 93 | if you allocate 2Gb on the server, it'll probably hold about 2Gb of backed up files (depending on the |
|---|
| 94 | compressability of those files).</p> |
|---|
| 95 | |
|---|
| 96 | <p>The backup client will (voluntarily) try not to upload more data than is allowed by the soft limit. |
|---|
| 97 | The store server will refuse to accept a file if it would take it over the hard limit, and when doing |
|---|
| 98 | housekeeping for this account, try and delete old versions and deleted files to reduce the space taken |
|---|
| 99 | to below the soft limit.</p> |
|---|
| 100 | |
|---|
| 101 | <p>This command will create some files on disc in the raid file directories (if you run as root, the utility will |
|---|
| 102 | change to the user specified in the bbstored.conf file to write them) and update the accounts file. A server |
|---|
| 103 | restart is not required.</p> |
|---|
| 104 | |
|---|
| 105 | <p><b>NOTE</b> If you get a message saying '<tt>Exception: RaidFile (2/8)</tt>', the directories you specified |
|---|
| 106 | in the raidfile.conf are not writable by the _bbstored user -- fix it, and try again.</p> |
|---|
| 107 | |
|---|
| 108 | <p>Finally, tell the user their account number, and the hostname of your server. They will use this to |
|---|
| 109 | <a href="client.html">set up the backup client</a>, and send you a CSR. This has the account number embedded |
|---|
| 110 | in it, and you should be sure that it has the right account number in it.</p> |
|---|
| 111 | |
|---|
| 112 | <p>Sign this CSR with</p> |
|---|
| 113 | |
|---|
| 114 | <pre> |
|---|
| 115 | /usr/local/bin/bbstored-certs ca sign 75AB23C-csr.pem |
|---|
| 116 | </pre> |
|---|
| 117 | |
|---|
| 118 | <p>Don't forget to check that the embedded account number is correct! Then send the two files back to the user, |
|---|
| 119 | as instructed by the script.</p> |
|---|
| 120 | |
|---|
| 121 | <p>Please read the <a href="trouble.html">Troubleshooting</a> page if you have problems.</p> |
|---|
| 122 | |
|---|
| 123 | |
|---|
| 124 | <h2>Finding disc space used, and changing limits.</h2> |
|---|
| 125 | |
|---|
| 126 | <p>To display the space used on the server for an account, use</p> |
|---|
| 127 | |
|---|
| 128 | <pre> |
|---|
| 129 | /usr/local/bin/bbstoreaccounts info 75AB23C |
|---|
| 130 | </pre> |
|---|
| 131 | |
|---|
| 132 | <p>To adjust the soft and hard limits on an account, use</p> |
|---|
| 133 | |
|---|
| 134 | <pre> |
|---|
| 135 | /usr/local/bin/bbstoreaccounts setlimit 75AB23C new-soft-limit new-hard-limit |
|---|
| 136 | </pre> |
|---|
| 137 | |
|---|
| 138 | <p>You do not need to restart the server if the limits are changed.</p> |
|---|
| 139 | |
|---|
| 140 | |
|---|
| 141 | <h2>Deleting an account</h2> |
|---|
| 142 | |
|---|
| 143 | <p>To remove an account, deleting all the stored files on the server and removing |
|---|
| 144 | the account information which allows a client to log in, use</p> |
|---|
| 145 | |
|---|
| 146 | <pre> |
|---|
| 147 | /usr/local/bin/bbstoreaccounts delete 75AB23C |
|---|
| 148 | </pre> |
|---|
| 149 | |
|---|
| 150 | <p>This will ask for confirmation. Append <tt>yes</tt> to the command to delete |
|---|
| 151 | without confirmation.</p> |
|---|
| 152 | |
|---|
| 153 | |
|---|
| 154 | <h2>Verifying a store account</h2> |
|---|
| 155 | |
|---|
| 156 | <p>To check that a store account is not corrupt, and optionally fix any errors, |
|---|
| 157 | use</p> |
|---|
| 158 | |
|---|
| 159 | <pre> |
|---|
| 160 | /usr/local/bin/bbstoreaccounts check 75AB23C |
|---|
| 161 | /usr/local/bin/bbstoreaccounts check 75AB23C fix |
|---|
| 162 | </pre> |
|---|
| 163 | |
|---|
| 164 | <p>The second command will fix errors it finds, the first will merely report them.</p> |
|---|
| 165 | |
|---|
| 166 | <p>Append <tt>quiet</tt> to reduce the amount of output, although errors are always reported.</p> |
|---|
| 167 | |
|---|
| 168 | <p>See <a href="serverfix.html">fixing problems with corruption on the server</a> for more information.</p> |
|---|
| 169 | |
|---|
| 170 | |
|---|
| 171 | <p> </p> |
|---|
| 172 | <p>© Ben Summers, 2003, 2004</p> |
|---|
| 173 | <p> </p> |
|---|
| 174 | </div> |
|---|
| 175 | </div> |
|---|
| 176 | </body> |
|---|
| 177 | </html> |
|---|
| 178 | |
|---|
| 179 | |
|---|
