Tutoriel : Automatiser ses sauvegardes chiffrées

$ lsblk -f
NAME   FSTYPE LABEL UUID MOUNTPOINT
sda
├─sda1                   /boot/efi
├─sda2                   /pedoporn
├─sda3                   /nsa_backdoor
├─sda4                   /media/windows_backdoor_for_everyone
├─sda5                   /media/DATA
├─sda6                   /google_backdoor
├─sda7                   [SWAP]
├─sda8                   /home
├─sda9                   /
└─sda10                  /docker_backdoor
sdb
├─sdb1
└─sdb2

# ou:
$ blkid
/dev/sdb2: UUID="d9ad7a7b-24c6-4995-9c53-4afa352a9416" TYPE="ext4" PARTUUID="69a6bda8-e1a0-4dc5-8452-1eaf50d7fd77"

# ou tout simplement:
$ ls -la /dev/disk/by-uuid/
lrwxrwxrwx 1 root root  10 sept.  1 20:41 d9ad7a7b-24c6-4995-9c53-4afa352a9416 -> ../../sdb2

$ sudo apt-get install cryptsetup

$ sudo cryptsetup luksFormat -c aes -h sha256 /dev/sdb2

$ sudo cryptsetup luksOpen /dev/sdb2 cryptdisk

$ sudo mkfs.ext4 /dev/mapper/cryptdisk

$ sudo mkdir /media/cryptdisk

$ sudo mount /dev/mapper/cryptdisk /media/cryptdisk

$ sudo chown -R cazeneuve:cazeneuve

$ sudo umount /media/cryptdisk
$ sudo cryptsetup luksClose cryptdisk

$ ls -la /dev/disk/by-uuid/
lrwxrwxrwx 1 root root  10 sept.  1 21:16 c968bc41-a980-4900-9490-00b2a5ed1d4e -> ../../sdb2
lrwxrwxrwx 1 root root  10 sept.  1 21:16 86cee552-66b9-4ab7-92f5-f401ee37de01 -> ../../dm-0

$ blkid
/dev/sdb2: UUID="c968bc41-a980-4900-9490-00b2a5ed1d4e" TYPE="crypto_LUKS" PARTUUID="917abaf8-7ad9-4ca8-b046-36116322c557"
/dev/mapper/luks-c968bc41-a980-4900-9490-00b2a5ed1d4e: UUID="86cee552-66b9-4ab7-92f5-f401ee37de01" TYPE="ext4"

# <file system>                            <mount point>     <type>  <options>                           <dump>  <pass>
UUID=86cee552-66b9-4ab7-92f5-f401ee37de01  /media/cryptdisk  ext4    defaults,noatime,nodiratime,noauto  0       2

# <target name>  <source device>                            <key file>  <options>
cryptdisk        UUID=c968bc41-a980-4900-9490-00b2a5ed1d4e  none        luks,timeout=10

rsync --stats -av --force --ignore-errors --delete --delete-excluded \
    --exclude-from=exclude_file \
    --include-from=include_file \
    --backup --backup-dir="$(date +%Y-%m-%d)/" \
    "source/dir/" "current/" \
    &> log_file.log

-a, --archive               archive mode; equals -rlptgoD (no -H,-A,-X)
-r, --recursive             recurse into directories
-l, --links                 copy symlinks as symlinks
-p, --perms                 preserve permissions
-t, --times                 preserve modification times
-g, --group                 preserve group
    --devices               preserve device files (super-user only)
    --specials              preserve special files
-D                          same as --devices --specials
-o, --owner                 preserve owner (super-user only)

-v, --verbose               increase verbosity
--stats                     give some file-transfer stats

--delete
    supprime les fichiers qui sont dans le répertoire de destination et pas dans le répertoire source
--ignore-errors
    delete even if there are I/O errors
--force
    force la suppression de répertoires même non-vides

--backup
    crée des sauvegardes des fichiers avant de les écraser en les écrivant sur eux-mêmes
--backup-dir=`date +%Y-%m-%d`
    crée un répertoire de backup daté pour ces sauvegardes

--exclude-from=FILE
    This option is related to the --exclude option, but it specifies a FILE that contains exclude patterns (one per line).
    Blank lines in the file and lines starting with ';' or '#' are ignored.
--include-from=FILE
    This option is related to the --include option, but it specifies a FILE that contains include patterns (one per line).
    Blank lines in the file and lines starting with ';' or '#' are ignored.

    Note also that excluding a directory prevents it not only from being copied but also from being traversed, so this effectively excludes everything below it. See this rsync filter primer for more information.
    If you exclude a directory, this excludes everything below it.
    If you include a directory, this doesn't automatically include its contents. In recent versions, --include='directory/***' will do that.
    * : any substring of a single directory component (i.e. never matches /);
    ** : matches any path substring.


    Exemple de syntaxe:

        + Users
        + Users/Cazeneuve
        + Users/Cazeneuve/Desktop
        + Users/Cazeneuve/Desktop/**
        - *

        # ou plus rapide:
        + Users
        + Users/Cazeneuve
        + Users/Cazeneuve/Desktop/***
        - *

#!/bin/bash
########################################
# Script for incremental rsync backups #
# Return 1 on errors, 0 otherwise      #
########################################

# Names of saved directories
BACKUP_NAME_WINDOWS="windows"
BACKUP_NAME_DATA="DATA"
BACKUP_NAME_DEBIAN="home"

# Paths of directories to save
SRC_WINDOWS="/media/windows/"
SRC_DEBIAN="/home/Lex/"
SRC_DATA="/media/DATA/"

# PS : Include patterns have to be specified
# as argument of backup_process function.

# Mount point of the partition/volume where the backup will be made
MOUNT_POINT="/media/cryptdisk"
# Root directory of backup stuff
BACKUP_ROOT="backups"

########################################
# From here on out, you probably don't #
#   want to change anything unless you #
#   know what you're doing.            #
########################################

CURRENT_DATE=$(date +%Y-%m-%d)
# Directory where the script and include/exclude files are stored
SCRIPT_DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
RED='\033[0;31m'
GREEN='\033[0;32m'
NC='\033[0m' # No Color
EXIT_VALUE=0

check_directories()
{
    # Check the existence of the directory where the last backup will be put
    # Param: Directory name

    #echo "Checking ${MOUNT_POINT}/${BACKUP_ROOT}/$1_current/ ..."

    if [ ! -d  "${MOUNT_POINT}/${BACKUP_ROOT}/$1_current/" ]; then
        echo -n "Init backup dir..."
        mkdir -p "${MOUNT_POINT}/${BACKUP_ROOT}/$1_current/"

        # get the exit code from the last command executed
        if [ $? -ne 0 ]; then
            echo -e " [${RED}FAIL${NC}]"
            # Stop the script
            exit 1
        else
            # 0 on success
            echo -e " [ ${GREEN}OK${NC} ]"
            return 0
        fi
    fi
}

backup_process()
{
    # Check directory & do the backup process
    # Param 1: Path of directory to save
    # Param 2: Name used for the destination
    # Param 3 (optional): File with patterns that will filter the source files

    #check_directories $BACKUP_NAME_WINDOWS
    check_directories $2

    echo -n "Backup $2 in progress..."

    LOG_FILE="${MOUNT_POINT}/${BACKUP_ROOT}/log_$2_$(date +%Y-%m-%d_%Hh-%Mm-%Ss).log"

    rsync --stats -av --force --ignore-errors --delete --delete-excluded \
        --exclude-from="${SCRIPT_DIR}/exclude_all" \
        --include-from=$3 \
        --backup --backup-dir="${MOUNT_POINT}/${BACKUP_ROOT}/$2_${CURRENT_DATE}/" \
        $1 "${MOUNT_POINT}/${BACKUP_ROOT}/$2_current/" \
        &> ${LOG_FILE}

    # get the exit code from the last command executed
    if [ $? -ne 0 ]; then
        echo -e " cf log [${RED}FAIL${NC}]"
        # Update exit value
        EXIT_VALUE=1
        return 1
    else
        # 0 on success
        echo -e " [ ${GREEN}OK${NC} ]"
        return 0
    fi
}

#########################################

if df | grep -q $MOUNT_POINT; then

    # Check include files here as third parameter !
    backup_process $SRC_WINDOWS $BACKUP_NAME_WINDOWS "${SCRIPT_DIR}/include_windows"
    backup_process $SRC_DEBIAN $BACKUP_NAME_DEBIAN
    backup_process $SRC_DATA $BACKUP_NAME_DATA "${SCRIPT_DIR}/include_DATA"
else
    echo -e "ERROR: Can't find mount point ! [${RED}FAIL${NC}]"
    EXIT_VALUE=1
fi

# Uncomment these lines if the script is not run through systemd (in user env)
#if [ $EXIT_VALUE -ne 0 ]; then
#    kdialog --passivepopup "Some errors occured !"
#else
#    kdialog --passivepopup "Backup is done."
#fi
exit $EXIT_VALUE

backup_process $SRC_DATA $BACKUP_NAME_DATA "${SCRIPT_DIR}/include_DATA"

# List mount targets: systemctl list-units -t mount
[Unit]
# Contains information about the service.
Description=Auto backup of the system to a LUKS encrypted partition.
Requires=media-cryptdisk.mount
# Launch after mounting the partition
After=media-cryptdisk.mount

[Service]
# Action of the service itself
ExecStart=/home/MY_USERNAME/backups/script.sh

[Install]
WantedBy=media-cryptdisk.mount

$ systemctl enable auto-backup-cryptdisk.service
Created symlink from /etc/systemd/system/media-cryptdisk.mount.wants/auto-backup-cryptdisk.service to /etc/systemd/system/auto-backup-cryptdisk.service.

$ systemctl --system daemon-reload

$ systemctl status auto-backup-cryptdisk.service
● auto-backup-cryptdisk.service - Auto backup of the system to a LUKS encrypted partition.
    Loaded: loaded (/etc/systemd/system/auto-backup-cryptdisk.service; enabled)
    Active: inactive (dead) since jeu. 2016-09-01 15:38:51 CEST; 2s ago
    Process: 7140 ExecStart=/home/Lex/Desktop/backups/script.sh (code=exited, status=0/SUCCESS)
    Main PID: 7140 (code=exited, status=0/SUCCESS)

sept. 01 15:38:17 kali script.sh[7140]: Backup windows in progress... [ OK ]
sept. 01 15:38:25 kali script.sh[7140]: Backup home in progress... [ OK ]
sept. 01 15:38:38 kali script.sh[7140]: Backup DATA in progress... [ OK ]