I made an iam user with the policy to only be able to put files wich make them not being able to list or delete any files. They can however replace files with the same name, so I tar the files with a filename that is partly random. Not perfect, but should be enough to protect them.

I’m only copying the webfiles, databases and scripts for setting up the server and configure the services, crontabs, etc. Since it’s only one file, it’s only one put and about 25MB storage every day for me. I don’t automatically delete any backups.

I too am also wondering about that. Looking at S3 stuff the upload/delete options are in the same security setting… >:

Wonder if its possible to SCP to another sever, and have that user only have upload only ability.

Thanks.

Thank you very much for taking the diligence in crafting a modern backup solution.

On my a Mac it appears the GNUPG library is not installed by default so users should download and install that first, or build the key on the server (as I did).

Also, though not noted in the instructions to run the duplicity script you need python-boto installed. The two commands to install that are here: http://goo.gl/9NmDC

I have a few questions regarding your instructions.

1. When generating a key, the system creates a folder called “.gnupg” with several files. Which file is a the private key and which file is the public key? To note, as of this writing DSA is no longer the default “RSA and RSA” is now the default option which I choose along with 4096 key size.

2. In your example script you mention adding the user values for the first three lines. Do we redudantly add those same values next to export = in the last three lines as well?

3. For “s3+http://BUCKETNAME” what format do we use for custom domains since Amazon now supports custom domains. Would it be “s3+http://backup.example.com” or in the format of “s3+http://backup.example.com.s3.amazonaws.com“? Or does this script not currently support custom domains?

4. For what would the structure be for the directory we want to backup. For example if I’ logged in as user chris and want to backup the contents of a folder called “test” in my home directory would I use: “/home/chris/test/”?

Those are my current questions as I currently get and error when running the script but believe its do to a home directory or more likely the bucketname format in correct. Thanks in advance!

The timing of the post has become quite ironic. 2 days after I published it, all hell breaks loose on my server and it’s been down most of the past 2 days. I’d have lost my sanity by now if I didn’t know I had those backups…
Hoteluri Bucuresti

i read it yesterday when i was searching for backup ideas for my site that is hosted on Amazon EC2 instance. Although I create EBS backups but don’t think I can do that daily and keep versions for 6 months – that will become too costly as every time it will create a snapshot of 15GB. And there does not seem to be a way to selectively restore individual files (i may be ignorant here)

so i tried the script, tested it using smaller backups initially without encryption, and later with encryptions. i must say that i did not know about how to create backups till one day earlier and now i’m up and running with a solid backup for my server just in a day’s time, thanks for your detailed instructions.

And by the way, i tested exporting and importing keys, and i’m able to restore my backups on different systems, too. sometimes gpg requires signing of the key after import (gpg –sign-key user-id). if it still does not work after signing, increase the trust level to 5 (gpg –edit-key and then command> trust).