Amanda Enterprise Edition 3.0 Administrators Guide

Configuration templates

The Amanda server configuration file, amanda.conf, is created from multiple configuration files. These configuration file templates are installed in /var/lib/amanda/template.d directory.

amanda.conf 

Configuration parameters that should usually be set for each Amanda installation. This file includes all other configuration files. This file should be in the /etc/amanda/configuration_name/ configuration directory. Templates for disk based backups (amanda-harddisk.conf), single tape drive configuration (amanda-single-tape.conf) and tape changer configuration (amanda-tape-changer.conf) are available in the template.d directory.

Example: amanda.conf file template for disk backups

org "DailySet1 " # your organization name for reports
mailto "amandabackup" # space separated list of operators at your site
dumpcycle 1 week # the number of days in the normal dump cycle
runspercycle 5 # the number of amdump runs in dumpcycle days
# (4 weeks * 5 amdump runs per week -- just weekdays)
tapecycle 25 tapes # the number of tapes in rotation
# 4 weeks (dumpcycle) times 5 tapes per week (just
# the weekdays) plus a few to handle errors that
# need amflush and so we do not overwrite the full
# backups performed at the beginning of the previous
# cycle
runtapes 1 # number of tapes to be used in a single run of amdump
tpchanger "chg-disk" # the tape-changer glue script
tapedev "file://var/lib/amanda/backup" # the no-rewind tape device to be used
changerfile "/etc/amanda/DailySet1/changer.conf"
changerdev "/dev/null"
tapetype HARDDISK # what kind of tape it is
labelstr "^DailySet1-[0-9][0-9]*$" # label constraint regex: all tapes must match
dtimeout 1800 # number of idle seconds before a dump is aborted.
ctimeout 30 # maximum number of seconds that amcheck waits
# for each client host
etimeout 300 # number of seconds per filesystem for estimates.

includefile "./advanced.conf"
includefile "/etc/amanda/template.d/dumptypes"
includefile "/etc/amanda/template.d/tapetypes"

advanced.conf 

Configuration parameters that are less likely to be changed for each Amanda backup configuration. This file is included by amanda.conf. This file should be present in /etc/amanda/configuration_name/ directory.

dumptypes 

All supported dumptypes are listed in the /etc/amanda/template.d/dumptypes file. Dumptype configurations are shared by all Amanda configurations on the Amanda server. If a dumptype configuration must be customized, add it to amanda.conf by including the dumptype template.

Example: Customized dumptype configuration to exclude GIF files in amanda.conf

dumptype custom_exclude_tar {
  user-tar
  exclude-file *.gif
}

tapetypes 

All supported tapetype definitions are included in the /etc/amanda/template.d/tapetypes file. Tapetype definitions are shared by all configurations on the Amanda server. Add new or customized tapetype definitions to amanda.conf.

Configuration tools

Amanda configuration tools must be run as the amandabackup user.

$ amserverconfig --template harddisk new_config1

$ amserverconfig --tapedev /dev/nst2 --tapecycle 30  new_config2

$ amaddclient --config new_config1 --client client1.zmanda.com --diskdev /home

$ amaddclient --config new_config2 --client client2.zmanda.com --diskdev /usr --excludefile ./tmp

Configuring Amanda with templates

This section provides an example configuration using configuration templates. This example backs up the /var/log directory from the Amanda client copper.zmanda.com to disk storage on the Amanda server quartz.zmanda.com using the harddisk configuration template. All configuration steps are performed on the Amanda server (quartz.zmanda.com).

1. Switch user to amandabackup, the Amanda backup user: su - amandabackup
2. Run the amserverconfig command with the harddisk configuration template parameter to create an amanda.conf file:

$ /usr/sbin/amserverconfig dailyset1 --template harddisk
Logging to /tmp/amanda/amserverconfig.20070520090207.debug
/var/lib/amanda/gnutar-lists directory exists
/etc/amanda/template.d directory created
/etc/amanda/dailyset1/amanda.conf created and updated
/etc/amanda/dailyset1/advanced.conf created and updated
curinfo and index directory created
tapelist file created
disklist.conf file created
DONE

Note:

• The created amanda.conf sets the mailto parameter to the amandabackup user. All mail notifications regarding backups in this configuration are sent to user amandabackup on the Amanda server. If you have not already done so, set up an email account for the amandabackup user.

* Add a client and the directory to be backed up using amaddclient 

Example: copper.zmanda.com as Amanda client to backup /var/log directory

$ /usr/sbin/amaddclient --config dailyset1 --client copper.zmanda.com --diskdev /var/log/
Logging to /tmp/amanda/amclientconfig.20070520101637.debug
/etc/amanda/dailyset1/disklist.conf updated
updating /var/lib/amanda/.amandahosts on quartz
/var/lib/amanda/.amandahosts contains copper.zmanda.com root, file not updated
I am attempting to update /var/lib/amanda/.amandahosts on copper.zmanda.com
.amandahosts                                                                 100%  109     0.1KB/s   00:00
.amandahosts.tmp                                                             100%  130     0.1KB/s   00:00
copper.zmanda.com:/var/lib/amanda/.amandahosts updated successfully

Note:

• If the Amanda client is same as the Amanda server, you must add localhost amandabackup amdump and copper.zmanda.com amandabackup amdump to the /var/lib/amanda/.amandahosts file on quartz.zmanda.com
• If ssh public-key authentication is set up between the Amanda server and the client, the amaddclient command updates /var/lib/amanda/.amandahosts on the Amanda client using scp. Otherwise, amaddclient returns a message specifies what needs to be added to /var/lib/amanda/.amandahosts on the client machine. To set up public-key authentication:

1. Copy ~amandabackup/.ssh/id_rsa_amdump.pub to the client machine through a secure channel(*) and append it to the ~amandabackup/.ssh/authorized_keys file. (*)For example: copy id_rsa.pub to a floppy or flash drive and hand carry to the client machine.
2. Run ssh-add on the Amanda server to add the RSA identities to the authentication agent.
3. Change file permissions

$ chmod 600 ~amandabackup/.ssh/authorized_keys

• Run the Amanda configuration check tool - amcheck command.

Example: Running amcheck on configuration "dailyset1"

$ /usr/sbin/amcheck dailyset1
Amanda Tape Server Host Check
-----------------------------
slot 25: read label `dailyset1-25', date `X'
NOTE: skipping tape-writable test
Tape dailyset1-25 label ok
NOTE: host info dir /etc/amanda/dailyset1/curinfo/copper does not exist
NOTE: it will be created on the next run.
NOTE: index dir /etc/amanda/dailyset1/index/copper does not exist
NOTE: it will be created on the next run.
Server check took 0.120 seconds

Amanda Backup Client Hosts Check
--------------------------------
Client check: 1 host checked in 0.055 seconds, 0 problems found

(brought to you by Amanda 3.0)

Amanda Backup Client Hosts Check
--------------------------------
WARNING: debian-client: selfcheck request failed: tcpm_recv_token:
invalid size: amandad: error while loading shared libraries:
libssl.so.4: cannot open shared object file: No such
Client check: 1 host checked in 0.051 seconds.  1 problem found.
(brought to you by Amanda 3.0)

Amanda Backup Client Hosts Check
--------------------------------
WARNING: ubuntu-client: selfcheck request failed: tcpm_recv_token:
invalid size: amandad: error while loading shared libraries:
libcrypto.so.4: cannot open shared object file: No su
Client check: 1 host checked in 0.678 seconds. 1 problem found.
(brought to you by Amanda 3.0)

#  ln -s /usr/lib/libssl.so.0.9.8 /usr/lib/libssl.so.4
#  ln -s /usr/lib/libcrypto.so.0.9.8 /usr/lib/libcrypto.so.4

$ /usr/sbin/amdump dailyset1
You have mail in /var/mail/amandabackup

amreport dailyset1 -f dailyset1.log -l /etc/amanda/dailyset1/log20090501124748.0

These dumps were to tape dailyset1-25.
The next tape Amanda expects to use is: a new tape.
The next new tape already labelled is: dailyset1-1.

STATISTICS:
                       Total       Full      Incr.
                       --------   --------   --------
Estimate Time (hrs:min)    0:00
Run Time (hrs:min)         0:00
Dump Time (hrs:min)        0:00       0:00       0:00
Output Size (meg)           8.6        8.6        0.0
Original Size (meg)         8.5        8.5        0.0
Avg Compressed Size (%)     --         --         --
Filesystems Dumped            1          1          0
Avg Dump Rate (k/s)     10771.1    10771.1        --

Tape Time (hrs:min)        0:00       0:00       0:00
Tape Size (meg)             8.6        8.6        0.0
Tape Used (%)               0.2        0.2        0.0
Filesystems Taped             1          1          0

Chunks Taped                  0          0          0
Avg Tp Write Rate (k/s)  9442.1     9442.1        --

USAGE BY TAPE:
Label              Time      Size      %    Nb    Nc
dailyset1-25       0:00     8800K    0.2     1     0

NOTES:
planner: Adding new disk copper:/var/log/.

Creating customized configurations

This section provides an example for creating customized Amanda configurations instead of using configuration templates. This example backs up the /var/log directory from the Amanda client copper.zmanda.com to disk storage (/mnt/storage) on the Amanda server quartz.zmanda.com using the harddisk configuration template. All commands are executed on the Amanda server quartz.zmanda.com

See Notes in the Configuring Amanda with templates for the amserverconfig and amaddclient commands (Steps 1 and 2).

• Customize configuraton using amserverconfig command.

Example: Creating customer configuration "dailyset1"

$ /usr/sbin/amserverconfig dailyset1 --tapedev "file://mnt/storage" --tapetype HARDDISK --tpchanger chg-disk \
--changerfile "/etc/amanda/dailyset1/changer.conf" --changerdev /dev/null --labelstr "^dailyset1-[0-9][0-9]*$" \
--mailto "amandabackup" --dumpcycle 5days --runspercycle 5 --runtapes 1 --tapecycle 25
Logging to /tmp/amanda/amserverconfig.20070502142202.debug
/var/lib/amanda/gnutar-lists directory exists
/etc/amanda/template.d directory created
custom amanda.conf created
/etc/amanda/dailyset1/advanced.conf created and updated
curinfo and index directory created
tapelist file created
disklist.conf file created
DONE.

• Add Amanda client - copper.zmanda.com and directory to be backed up using amaddclient.

Example: Using amaddclient to add Amanda client

$ /usr/sbin/amaddclient --config dailyset1 --client copper.zmanda.com --diskdev /var/log/
Logging to /tmp/amanda/amclientconfig.20070502101637.debug
/etc/amanda/dailyset1/disklist.conf updated
updating /var/lib/amanda/.amandahosts on quartz
/var/lib/amanda/.amandahosts contains copper.zmanda.com root, file not updated
I am attempting to update /var/lib/amanda/.amandahosts on copper.zmanda.com
.amandahosts                                                                     100%  109     0.1KB/s   00:00
.amandahosts.tmp                                                                 100%  130     0.1KB/s   00:00
copper.zmanda.com:/var/lib/amanda/.amandahosts updated successfully

• amserverconfig will create 25 virtual tape slot directories under "/mnt/storage" directory and label them using amlabel.

• Check Amanda configuration with amcheck command.

Example: Running amcheck on configuration "dailyset1"

$ /usr/sbin/amcheck dailyset1
Amanda Tape Server Host Check
-----------------------------
slot 1: read label `dailyset1-1', date `X'
NOTE: skipping tape-writable test
Tape dailyset1-1 label ok
NOTE: host info dir /etc/amanda/dailyset1/curinfo/copper.zmanda.com does not exist
NOTE: it will be created on the next run.
NOTE: index dir /etc/amanda/dailyset1/index/copper.zmanda.com does not exist
NOTE: it will be created on the next run.
Server check took 0.144 seconds

Amanda Backup Client Hosts Check
--------------------------------
Client check: 1 host checked in 0.506 seconds, 0 problems found

(brought to you by Amanda 3.0)

• Force a backup run manually for testing the configuration.

Example: Running amdump on configuration "dailyset1"

$ /usr/sbin/amdump dailyset1
You have mail in /var/mail/amandabackup

• Check email for backup run report.

Example: Backup run report email message

These dumps were to tape dailyset1-1.
The next tape Amanda expects to use is: a new tape.
The next new tape already labelled is: dailyset1-2.

STATISTICS:
                          Total       Full      Incr.
                        --------   --------   --------
Estimate Time (hrs:min)    0:00
Run Time (hrs:min)         0:00
Dump Time (hrs:min)        0:00       0:00       0:00
Output Size (meg)           8.6        8.6        0.0
Original Size (meg)         8.6        8.6        0.0
Avg Compressed Size (%)     --         --         --
Filesystems Dumped            1          1          0
Avg Dump Rate (k/s)     10640.9    10640.9        --

Tape Time (hrs:min)        0:00       0:00       0:00
Tape Size (meg)             8.6        8.6        0.0
Tape Used (%)               0.2        0.2        0.0
Filesystems Taped             1          1          0

Chunks Taped                  0          0          0
Avg Tp Write Rate (k/s)  9723.8     9723.8        --

USAGE BY TAPE:
  Label             Time      Size      %    Nb    Nc
  dailyset1-1       0:00     8800K    0.2     1     0

NOTES:
planner: Adding new disk copper.zmanda.com:/var/log/.

Recommended configuration parameters

• "GNUTAR" is the recommended backup program for Amanda enterprise edition. The Program parameter in the dumptype section of amanda.conf should be set to "GNUTAR".
• "bsdtcp" is the recommended authentication mechanism between server and client. It uses fewer ports, thus simplifying firewall configuration.
• "ssh" is the recommended encryption method if encrypted communication is required at your site. Encryption increases backup times significantly, and should be enabled only if your site requires it. In the dumptype definition, the auth parameter should be set to "ssh" and the ssh_keys parameter then must be set to "/var/lib/amanda/.ssh/id_rsa_amdump".
• If you are using ssh for Amanda server and client authentication, encrypting client data is not necessary. In other words, do not use both auth "ssh" and encrypt client in the same dumptype.
• Always use indexing to track the files in the backup image.
• Use Fully Qualified Domain Names for hostnames in disklist entries. 

Example: Recommended dumptype configuration

define dumptype recommended-tar {
   global
   program "GNUTAR"
   comment "recommended dumptype configuration"
   auth "bsdtcp"
   index
   record yes
}

define dumptype copper-dumptype {
   ....
   auth "bsdtcp"
}

 define dumptype user-star {
         comment "Full dump of /boot using star
         global
         program "STAR"
         compress none
         priority high
 }

 copper.zmanda.com /boot user-star

(include|exclude)  file1 file2 file3

'(include|exclude) list filename'.

 AMANDA: FILE 20060414174126 localhost /tmp/amanda  lev 0 comp N program /usr/bin/star
 To restore, position tape at start of file and run:
       dd if=<tape> bs=32k skip=1 |    /usr/bin/star -f - ...
^L

$ star -x -v -xattr -f localhost._tmp_amanda.20060414174126.0 amandad.20060414165105.debug amandad.20060414165741.debug amandad.20060414170145.debug amandad.20060414174127.debug
Host name   ktill2.zmanda.com
File system /tmp/amanda
Working dir /tmp/amanda
Release     star 1.5a69 (i386-redhat-linux-gnu)
Archtype    exustar
Dumptype    partial
Dumplevel   0
Dumpdate    1145061704.555902 (Fri Apr 14 17:41:44 2006)
Volno       1
Blocksize   20
x amandad.20060414165105.debug 3636 bytes, 8 tape blocks
x amandad.20060414170145.debug 135656 bytes, 265 tape blocks
x amandad.20060414174127.debug 16393 bytes, 33 tape blocks
x amandad.20060414165741.debug 3636 bytes, 8 tape blocks
star: 70 blocks + 4096 bytes (total of 720896 bytes = 704.00k).

$ ls -Z
-rw-r-----  amandaba disk     system_u:object_r:amanda_tmp_t    amandad.20060414165105.debug
-rw-r-----  amandaba disk     system_u:object_r:amanda_tmp_t    amandad.20060414165741.debug
-rw-r-----  amandaba disk     system_u:object_r:amanda_tmp_t    amandad.20060414170145.debug
-rw-r-----  amandaba disk     system_u:object_r:amanda_tmp_t    amandad.20060414174127.debug
-rw-r-----  amandaba disk     amandabackup:object_r:sysadm_home_t  localhost._tmp_amanda.20060414174126.0

define dumptype global {
    tape_splitsize 4900 Mb
    ...
}

# /usr/sbin/amrecover test
AMRECOVER Version 2.6.3. Contacting server on localhost ...
220 quartz AMANDA index server (3.0) ready.
200 Access OK
Setting restore date to today (2007-05-02)
200 Working date set to 2007-05-02.
200 Config set to test.
amrecover> sethost localhost
200 Dump host set to localhost.
amrecover> setdisk /usr/tmp
200 Disk set to /usr/tmp.
amrecover> ls
2007-05-02-15-50-27 ssh_config
2007-05-02-15-50-27 foo.gpg
2007-05-02-15-50-27 foo
2007-05-02-15-50-27 config-2.6.11-1.1369_FC4smp
2007-05-02-15-50-27 asimple
2007-05-02-15-50-27 System.map-2.6.11-1.1369_FC4
2007-05-02-15-50-27 .

amrecover> setdate 2007-02-21-15-47-19
200 Working date set to 2007-02-21-15-47-19.
amrecover> ls
2007-02-21-15-47-19 ssh_config
2007-02-21-15-47-19 rpm-tmp.92294
2007-02-21-15-47-19 rpm-tmp.83787
2007-02-21-15-47-19 rpm-tmp.81866
2007-02-21-15-47-19 rpm-tmp.65537
2007-02-21-15-47-19 rpm-tmp.65462
2007-02-21-15-47-19 rpm-tmp.42926
2007-02-21-15-47-19 rpm-tmp.42601
2007-02-21-15-47-19 rpm-tmp.41519
2007-02-21-15-47-19 rpm-tmp.37869
2007-02-21-15-47-19 rpm-tmp.27296
2007-02-21-15-47-19 rpm-tmp.25634
2007-02-21-15-47-19 foo.gpg
2007-02-21-15-47-19 foo
2007-02-21-15-47-19 config-2.6.11-1.1369_FC4smp
2007-02-21-15-47-19 asimple
2007-02-21-15-47-19 System.map-2.6.11-1.1369_FC4
2007-02-21-15-47-19 .
amrecover>add *
Added file /ssh_config
Added file /rpm-tmp.92294
Added file /rpm-tmp.83787
Added file /rpm-tmp.81866
Added file /rpm-tmp.65537
Added file /rpm-tmp.65462
Added file /rpm-tmp.42926
Added file /rpm-tmp.42601
Added file /rpm-tmp.41519
Added file /rpm-tmp.37869
Added file /rpm-tmp.27296
Added file /rpm-tmp.25634
Added file /foo.gpg
Added file /foo
Added file /config-2.6.11-1.1369_FC4smp
Added file /asimple
Added file /System.map-2.6.11-1.1369_FC4
amrecover> extract

Extracting files using tape drive null: on host localhost.
The following tapes are needed: test-2

Restoring files into directory /tmp/recover
Continue [?/Y/n]? y

Extracting files using tape drive null: on host localhost.
Load tape test-2 now
Continue [?/Y/n/s/t]? y
./System.map-2.6.11-1.1369_FC4
./asimple
./config-2.6.11-1.1369_FC4smp
./foo
./foo.gpg
./rpm-tmp.25634
./rpm-tmp.27296
./rpm-tmp.37869
./rpm-tmp.41519
./rpm-tmp.42601
./rpm-tmp.42926
./rpm-tmp.65462
./rpm-tmp.65537
./rpm-tmp.81866
./rpm-tmp.83787
./rpm-tmp.92294
./ssh_config

amrecover> lcd /tmp/recover2
amrecover> setdate 2007-05-02-15-50-27
200 Working date set to 2007-05-02-15-50-27.
amrecover> ls
2007-05-02-15-50-27 ssh_config
2007-05-02-15-50-27 foo.gpg
2007-05-02-15-50-27 foo
2007-05-02-15-50-27 config-2.6.11-1.1369_FC4smp
2007-05-02-15-50-27 asimple
2007-05-02-15-50-27 System.map-2.6.11-1.1369_FC4
2007-05-02-15-50-27 .
amrecover> add *
Added file /ssh_config
Added file /foo.gpg
Added file /foo
Added file /config-2.6.11-1.1369_FC4smp
Added file /asimple
Added file /System.map-2.6.11-1.1369_FC4
amrecover> extract

Extracting files using tape drive null: on host localhost.
The following tapes are needed: test-1

Restoring files into directory /tmp/recover2
Continue [?/Y/n]? y

Extracting files using tape drive null: on host localhost.
Load tape test-1 now
Continue [?/Y/n/s/t]? y
./System.map-2.6.11-1.1369_FC4
./asimple
./config-2.6.11-1.1369_FC4smp
./foo
./foo.gpg
./ssh_config

mailer mail_program_path

MAILER -s "subject" user < message_file

Using amvault to copy a backup run to tertiary media

Amvault makes one-to-one copies of each piece of media used in a backup run The syntax for amvault is:

amvault [-o Amanda.conf_options] backup_set src-run-timestamp changer label-template

Amanda.conf_options can be any of the options described in amanda.conf (5).

Backup_set is the name of the source backup set.

src-run-timestamp is the timestamp of the backup run you wish to copy. Specify lastest uses the most recent run.

changer is the name of the changer to use as defined by amanda.conf (5).

label-template specifies the string used to prefix the tertiary backup media labels. The string should contain some number of contiguous % characters, which will be replaced with a generated number. Be sure to specify enough % characters that you do not run out of tape labels. Example: DailySet1-%%%

For example, to produce a tertiery backup of MyBackupSet to changer MyChanger with label prefixes of "off-site-N" for the tertiary backup media, you would enter the following command:

amvault MyBackupSet latest MyChanger off-site-%%%

The amvault (8) man page describes these options in more detail.

Restoring from Tertiary Media

When you use  amrecover(8) against a backup set, Amanda looks for secondary backup media to restore from first. If none is found, it automatically looks for tertiary media to restore from. 

Configuration file changes on the Amanda server

Update amanda.conf

Change auth in the dumptype definition to use one of the supported authentication mechanisms - bsd, bsdudp, bsdtcp or ssh. "bsdtcp" is recommended.

The auth chosen needs to match the authentication chosen in xinetd.conf and amanda-client.conf configuration files on the Amanda client.

If SSH is chosen, add ssh_keys to the dumptype definition.

Example:

ssh_keys "/var/lib/amanda/.ssh/id_rsa_amdump"

Update /etc/xinetd.d/amandaserver

This step must be performed as root.

If bsdudp authentication is being used, add the following line to the amanda service entry:

"server_args             = -auth=bsdudp amindexd amidxtaped"

For bsdtcp authentication, replace the amanda service entry in /etc/xinetd.conf/amandaserver file to:

   service amanda
   {
       disable               = no
       socket_type     = stream
       protocol        = tcp
       wait            = no
       user                  = amandabackup
       group                 = disk
       groups                = yes
       server                = /usr/lib/amanda/amandad
       server_args     = -auth=bsdtcp amindexd amidxtaped
   }

No changes are required for "bsd" and "ssh" authentication Update /var/lib/amanda/.amandahosts to 2.5.1 or later format

Amanda enterprise edition 2.5.0 format: <client FQDN hostname> root Amanda enterprise edition 2.5.1 or later format: <client FQDN hostname> root amindexd amidxtaped amanda

For example: The following line allows the Amanda client, iron.zmanda.com, to connect to the Amanda server to perform data recovery

  iron.zmanda.com root amindexd amidxtaped

To use ssh auth, generate ssh-key and distribute to all clients. Run the following command:

   ssh-keygen -t rsa

Enter the name of a file in which to save the key (/var/lib/amanda/.ssh/id_rsa)? /var/lib/amanda/.ssh/id_rsa_amdump

Copy /var/lib/amanda/.ssh/id_rsa_amdump.pub to Amanda client machines through a secure channel.

Prepend the line with the following:

from="tape_server_fqdn_name",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,command="/path/to/amandad -auth=ssh amdump"

Append it to /var/lib/amanda/.ssh/authorized_keys and set file permissions for authorized_keys appropriately.

$ chmod 600 ~amandabackup/.ssh/authorized_keys

Example:

from="quartz.zmanda.com",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,command="/usr/lib/amanda/amandad -auth=ssh amdump"  ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAzVBUEN7XO/s9F0178V41HZE7GdNnnAQh7kMDbQD4eo1m9Zqc257XlZC97YY76WHBNI163Tof7dnS8aSmVfIPUZHQRYIPtY9abESTGJkOuLxZRjsnQWHQ0sBdZ5VEmDzEt8SAnaESoZS2IFffe5sTHtAKhbjhIOVvfCkGe1tW9K0= [email protected]

Make sure the Amanda client is in the SSH known_hosts file

# ssh iron.zmanda.com
The authenticity of host 'iron.zmanda.com (192.168.10.1)' can't be established.
RSA key fingerprint is 26:4e:df:a2:be:c8:cb:20:1c:68:8b:cc:c0:3b:8e:9d.
Are you sure you want to continue connecting (yes/no)?yes

Set ssh_keys in the dumptype.

ssh_keys "/var/lib/amanda/.ssh/id_rsa_amdump"

Configuration file changes on Amanda Client

Create /etc/amanda/amanda-client.conf.
See Amanda-client.conf man page for details. This configuration file is used by recovery process only. Example: amanda_client.conf

  conf "test"
  index_server "quartz.zmanda.com"
  auth "bsdtcp"                       # auth chosen needs to match what is running on the Amanda Server
  tape_server "quartz.zmanda.com"
  ssh_keys "/var/lib/amanda/.ssh/id_rsa_amrecover"   #only if ssh is used

Update /etc/xinetd.d/amandaclient

No changes are required for bsd and ssh configuration files.

For bsdudp authentication, Add the following line to amanda service entry

               "server_args             = -auth=bsdudp amdump"

For bsdtcp authentication, replace the amanda service entry in /etc/xinetd.conf/amandaserver file with

service amanda
{
       disable               = no
       socket_type     = stream
       protocol        = tcp
       wait            = no
       user                  = amandabackup
       group                 = disk
       groups                = yes
       server                = /usr/lib/amanda/amandad
       server_args     = -auth=bsdtcp amdump
}

Update /var/lib/amanda/.amandahosts to 2.5.1 or later format

Amanda Enterprise Edition 2.5.0 format: <server FQDN hostname> amandabackup
Amanda Enterprise Edition 2.5.1 or later format: <server FQDN hostname> amandabackup amdump

Example: The following line allows Amanda server, quartz.zmanda.com to perform backups

  quartz.zmanda.com amandabackup amdump

• To use ssh auth, generate ssh-key and copy to Amanda Server

Log in to the system as superuser

  #ssh-keygen -t rsa
  Enter file in which to save the key (/root/.ssh/id_rsa)? /var/lib/amanda/.ssh/id_rsa_amrecover

Copy /var/lib/amanda/.ssh/id_rsa_amrecover.pub to Amanda server machines through a secure channel.
prepend the line with the following:

    from="client_fqdn_name",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,command="/path/to/amandad -auth=ssh amindexd amidxtaped"

Append it to /var/lib/amanda/.ssh/authorized_keys and set file permissions for authorized_keys appropriately.

$ chmod 600  /var/lib/amanda/.ssh/authorized_keys

Example:

from="copper.zmanda.com",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,command="/usr/lib/amanda/amandad -auth=ssh amindexd amidxtaped" ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA4rOMQbUJxDiMllx8pnjr3hLWZvubzDGKQYdzJATORRQoyUNaEt16Xna14IAYbpmrQLnmYUcgvE8+jP8XzO3LTqQQtcakds5TKTB6dDZ287U9mE/H7p5GvpHTyURFLQ2ymB9q37g07VdNcvGETCS0rkpCfZx4qU+9bMNuCm3LqJ0= [email protected]

Make sure server is in ssh known_hosts file

#ssh quartz.zmanda.com
The authenticity of host 'quartz.zmanda.com (192.168.10.1)' can't be established.
RSA key fingerprint is 26:4e:df:a2:be:c8:cb:20:1c:68:8b:cc:c0:3b:8e:9d.
Are you sure you want to continue connecting (yes/no)?yes

Set auth and ssh_keys in /etc/amanda/amanda-client.conf properly.

auth "ssh"
ssh_keys "/var/lib/amanda/.ssh/id_rsa_amrecover"

service amanda
{
disable                 = no
socket_type             = stream
protocol                = tcp
wait                    = no
user                    = amandabackup
group                   = disk
groups                  = yes
server                  = /usr/local/libexec/amandad
server_args             = -auth=bsdtcp amdump amindexd amidxtaped
}