HOWTO Encrypted Backup System Using Bacula and GnuPG

###################   DEFINE DIRECTOR   #############################
Director                     
{                                     
 Name = backup-dir                               #or whatever name you want
 Description = "Bacula Director - $MY_LOCATION"  # "Bacula Director - Main Office"
 DIRport = 9101                       
 QueryFile = "/etc/bacula/query.sql"
 WorkingDirectory = "/var/bacula"
 PidDirectory = "/var/run"
 Maximum Concurrent Jobs = 2
 FDConnectTimeout = 1min
 SDConnectTimeout = 1min
 Password = "$CONSOLE_PASSWORD"                  # "gsdfgfdsg44"
 Messages = Daemon
}

###################   DEFINE CLIENTS   ##############################

Client {
  Name = $SOME_IMPORTANT_CLIENT-fd              # accountant-fd
  Address = $FQDN_OR_IP                         # accountant.mydomain.local
  FDPort = 9102
  Catalog = GiantCatalog
  Password = "$CLIENT_ACCESS_PASSWORD"          # "strong_password"
  File Retention = 6 days
  Job Retention = 6 days
  AutoPrune = yes
  Maximum Concurrent Jobs = 2
}

Client {
  Name = $LAST_CLIENT-fd                       # mainserver-fd
  Address = $FQDN_OR_IP                        # mainserver.mydomain.local
  FDPort = 9102
  Catalog = GiantCatalog
  Password = "$LAST_CLIENT_ACCESS_PASSWORD"    # "strong_password2"
  File Retention = 6 days
  Job Retention = 6 days
  AutoPrune = yes
  Maximum Concurrent Jobs = 2
}

Client {
  Name = $BACKUP_SERVER-fd                       # the bacula server itself backup-fd
  Address = $FQDN_OR_IP                              # backup.mydomain.lan
  FDPort = 9102
  Catalog = GiantCatalog
  Password = "$BACKUP_SERVER_ACCESS_PASSWORD"    # "strong_password2"
  File Retention = 6 days
  Job Retention = 6 days
  AutoPrune = yes
  Maximum Concurrent Jobs = 2
}

############### DEFINE DEFAULT JOB PARAMETERS #####################

JobDefs                     
 {                               
 Name = "DefaultBackupJob"
 Type = Backup
 Level = Full
 Client = backup-fd
 Schedule = "WeeklyCycle"
 Storage = File
 Pool = Default
 Messages = Standard
 Priority = 10
 Max Start Delay = 18h
}

#######################  DEFINE JOBS  ############################

Job
{
 Name = "$SOME_IMPORTANT_CLIENT_JOB"             # "Accountant Backup Job"
 Client = $SOME_IMPORTANT_CLIENT-fd              # accountant-fd
 JobDefs = "DefaultBackupJob"
 FileSet = "Generic User Fileset"                #it can be reused for many clients
 Write Bootstrap = "/backups/bootstraps/$SOME_IMPORTANT_CLIENT.bsr"
 Maximum Concurrent Jobs = 2
}

#Backup the catalog database (after the nightly save)
Job {
  Name = "BackupCatalog"
  JobDefs = "DefaultBackupJob"
  Client = BACKUP_SERVER-fd
  FileSet="Catalog"
  # This creates an ASCII copy of the catalog
  RunBeforeJob = "/etc/bacula/make_catalog_backup bacula bacula"
  # This deletes the copy of the catalog
  RunAfterJob = "/etc/bacula/delete_catalog_backup"
  Write Bootstrap = "/backups/bootstraps/BackupCatalog.bsr"
  Priority = 10
}

Job
{
 Name = "$LAST_CLIENT_JOB"                      # "Mainserver Backup Job"
 Client = $LAST_CLIENT-fd                       # mainserver-fd
 JobDefs = "DefaultBackupJob"
 FileSet = "Server Fileset"                     #we can define a separate FileSet
 Write Bootstrap = "/backups/bootstraps/$LAST_CLIENT.bsr"
 Maximum Concurrent Jobs = 2
 RunAfterJob = "/backups/encrypted/scripts/EncryptVolume.sh"
## NOTE - we will run the script EncryptVolume.sh after this job completes.   ##
## It will encrypt volume, delete unencrypted volume and transfer it via FTP ##
}

################## Define which files to backup #####################

FileSet
{
  Name = "Generic User Fileset"
  Enable VSS = yes
  Include
  {
        Options
    {
        signature = MD5         #Create MD5 Signature
        compression=GZIP5       #Compress Incoming Data on the client
        Exclude = yes
        IgnoreCase = yes
        # Exclude Mozilla-based programs' file caches
        WildDir = "[A-Z]:/Documents and Settings/*/Application Data/*/Profiles/*/*/Cache"
        WildDir = "[A-Z]:/Documents and Settings/*/Application Data/*/Profiles/*/*/Cache.Trash"

        # Exclude directories full of lots and lots of useless little files
        WildDir = "[A-Z]:/Documents and Settings/*/Cookies"
        WildDir = "[A-Z]:/Documents and Settings/*/Recent"
        WildDir = "[A-Z]:/Documents and Settings/*/Local Settings/History"
        WildDir = "[A-Z]:/Documents and Settings/*/Local Settings/Temp"
        WildDir = "[A-Z]:/Documents and Settings/*/Local Settings/Temporary Internet Files"

        # These are always open and unable to be backed up
        WildFile = "[A-Z]:/Documents and Settings/All Users/Application Data/Microsoft/Network/Downloader/qmgr[01].dat"

        # Temporary directories & files
        WildDir = "[A-Z]:/WINNT/Temp"
        WildDir = "[A-Z]:/temp"
        WildFile = "*.tmp"

        # Recycle bins
        WildDir = "[A-Z]:/RECYCLER"

        # Swap files
        WildFile = "[A-Z]:/pagefile.sys"
   }

    File = "c:/Documents and Settings"          #Define Folders to back up
    File = "d:/SomePath/To Folder/Or/File.txt" 
  }

  Exclude
  {
    File = "c:/test"                            #Define Folders to exclude
  }
}

FileSet
{
  Name = "Server Fileset"
  Enable VSS = yes
  Include
  {
        Options
    {
        signature = MD5         #Create MD5 Signature
        compression=GZIP5       #Compress Incoming Data on the client
        Exclude = yes
        IgnoreCase = yes
        # Swap files
        WildFile = "[A-Z]:/pagefile.sys"
   }
    File = "d:/"          #Back Everything for this SPECIAL_USER
  }

  Exclude
  {
    File = "c:/test"                         #Define Folders to exclude
  }
}

###################   DEFINE SCHEDULE   ################################

Schedule {
  Name = "WeeklyCycle"
  Run = Level=Full Pool=MondayPool Monday at 12:05       #PM That is
  Run = Level=Full Pool=TuesdayPool Tuesday at 02:12     #AM that is
  Run = Level=Full Pool=WednesdayPool Wednesday at 12:05
  Run = Level=Full Pool=ThursdayPool Thursday at 12:05
  Run = Level=Full Pool=FridayPool Friday at 12:05
  Run = Level=Full Pool=SaturdayPool Saturday at 16:00
  Run = Level=Full Pool=SundayPool Sunday at 16:00
}

################# DEFINE STORAGE (file, tape, CDR..) ###################

Storage {
  Name = File                   
  Address = FQDN_OR_IP_OF_DIRECTOR         
  SDPort = 9103
  Password = "$STORAGEPASS"
  Device = FileStorage
  Media Type = File
}

############################ DEFINE CATALOG #############################

Catalog {
  Name = GiantCatalog
  dbname = bacula; user = bacula; password = ""
}

########################## DEFINE MESSAGES #############################

Messages {
  Name = Standard
  console = all, !skipped, !saved
  append = "/var/bacula/log" = all, !skipped
}

Messages {
  Name = Daemon
  console = all, !skipped, !saved
  append = "/var/bacula/log" = all, !skipped
}

#######################   DEFINE POOLS   ################################
Pool {
  Name = MondayPool
  Pool Type = Backup
  AutoPrune = yes               # Prune expired volumes
  Volume Retention = 6 days
  Accept Any Volume = yes       # write on any volume in the pool
  Volume Use Duration = 6 days
  Recycle = yes
  RecycleOldestVolume = yes
  LabelFormat = "BackupMondayVolume"
}

Pool {
  Recycle = yes                 
  Name = TuesdayPool
  Pool Type = Backup
  AutoPrune = yes                   
  Volume Retention = 6 days
  Accept Any Volume = yes             
  Volume Use Duration = 6 days
  Recycle = yes
  RecycleOldestVolume = yes
  LabelFormat= "BackupTuesdayVolume"
}

Pool {
  Recycle = yes               
  Name = WednesdayPool
  Pool Type = Backup
  AutoPrune = yes                     
  Volume Retention = 6 days
  Accept Any Volume = yes             
  Volume Use Duration = 6 days
  Recycle = yes
  RecycleOldestVolume = yes
  LabelFormat="BackupWednesdayVolume"
}

Pool {
  Recycle = yes                 
  Name = ThursdayPool
  Pool Type = Backup
  AutoPrune = yes                     
  Volume Retention = 6 days
  Accept Any Volume = yes             
  Volume Use Duration = 6 days
  Recycle = yes
  RecycleOldestVolume = yes
  LabelFormat="BackupThursdayVolume"
}

Pool {
  Recycle = yes                 
  Name = FridayPool
  Pool Type = Backup
  AutoPrune = yes                   
  Volume Retention = 6 days
  Accept Any Volume = yes           
  Volume Use Duration = 6 days
  Recycle = yes
  RecycleOldestVolume = yes
  LabelFormat="BackupFridayVolume"
}

Pool {
  Recycle = yes                 
  Name = SaturdayPool
  Pool Type = Backup
  AutoPrune = yes                   
  Volume Retention = 6 days
  Accept Any Volume = yes           
  Volume Use Duration = 6 days
  Recycle = yes
  RecycleOldestVolume = yes
  LabelFormat="BackupSaturdayVolume"
}

Pool {
  Recycle = yes               
  Name = SundayPool
  Pool Type = Backup
  AutoPrune = yes                 
  Volume Retention = 6 days
  Accept Any Volume = yes           
  Volume Use Duration = 6 days
  Recycle = yes
  RecycleOldestVolume = yes
  LabelFormat="BackupSundayVolume"
}

# Default pool definition
Pool {
  Name = Default
  Pool Type = Backup
}

# Restricted console used by tray-monitor to get the status of the director
Console {
  Name = backup-mon
  Password = "$RESTRICTED_CONSOLE_PASSWORD"
  CommandACL = status, .status
} 

Storage {                             # definition of myself
  Name = backup-sd
  SDPort = 9103                 
  WorkingDirectory = "/var/bacula"
  Pid Directory = "/var/run"
  Maximum Concurrent Jobs = 20
}

# List Directors who are permitted to contact Storage daemon
Director {
  Name = backup-dir
  Password = "$STORAGEPASS"
}

#
# Restricted Director, used by tray-monitor to get the
#   status of the storage daemon
#
Director {
  Name = backup-mon
  Password = "$RESTRICTED_DIR_PASS"
  Monitor = yes
}

Device {
  Name = FileStorage
  Media Type = File
  Archive Device = /backups
  LabelMedia = yes;                   # lets Bacula label unlabeled media
  Random Access = Yes;
  AutomaticMount = yes;               # when device opened, read it
  RemovableMedia = no;
  AlwaysOpen = no;
}

Messages {
  Name = Standard
  director = backup-dir = all
}

Director {
  Name = backup-dir            #mainofficebackup-dir
  DIRport = 9101
  address = $FQDN_OR_IP
  Password = "$DIRECTOR_CONSOLE_PASSWORD"
}

# Remove Yesterday’s encrypted backup from HDD
cd /backups/encrypted/
rm -f *.gpg

# encrypt the file with GPG using Public Key.
# use only --cipher-algo aes|aes192|aes256|twofish
gpg --encrypt --batch -r backup@giantmarkets.com  --cipher-algo twofish \
--bzip2-compress-level 6 --output /backups/encrypted/BakupVolume.gpg /backups/Backup*

# Remove unencrypted backup volume, we encrypted and saved
# encrypted copy in the above step.
cd /backups/
rm Backup*

# transfer encrypted volume via ftp to the server with tape
cd /backups/encrypted/

ftp -ni $FQDN_OR_IP <<SCRIPT
user Anonymous backup_job@backup
cd $SOME_FOLDER
binary
mdelete *.gpg
mput *.gpg
quit

Director {
  Name = backup-dir			#Director's name as defined on the server
  Password = "$CLIENT_ACCESS_PASSWORD"	#same as in client definition on server
}

FileDaemon {                          
  Name = $SOME_IMPORTANT_CLIENT-fd	
  FDport = 9102                  	
  WorkingDirectory = "C:\\Documents and Settings\\All Users\\Application Data\\Bacula\\Work"
  Pid Directory = "C:\\Documents and Settings\\All Users\\Application Data\\Bacula\\Work"
  Maximum Concurrent Jobs = 2
}

# Send all messages except skipped files back to Director
Messages {
  Name = Standard
  director = backup-dir = all, !skipped
}

Director {
  Name = backup-dir			        #Director's name as defined on the server
  Password = "$LAST_CLIENT_ACCESS_PASSWORD"	#same as in client definition on server
}

FileDaemon {                          
  Name = $LAST_CLIENT-fd	
  FDport = 9102                  	
  WorkingDirectory = /bacula/working
  Pid Directory = /bacula/working
}

# Send all messages except skipped files back to Director
Messages {
  Name = Standard
  director = backup-dir = all, !skipped
}