Exercise: Archives and transfer review

Archives and transfer review

• Create an xz archive with relative names, an exclusion and ACLs.
• Create and verify a checksum, and carry the archive between servers.
• Restore with ACLs and permissions intact.

Before you start: reset the servers and complete this chapter's lessons. You work from workstation, using ssh root@servera and ssh root@serverb; lab start and lab grade also run there.

1. On servera, build the project tree (the commands are in the README).
2. Create /srv/backup/project.tar.xz from /srv/project with names starting project/, without cache, keeping ACLs, SELinux labels and extended attributes. Write project.tar.xz.sha256 next to it and verify it.
3. Copy both files to /srv/restore on serverb through workstation, verify the checksum on serverb, and extract the archive there, keeping ACLs.

Start the exercise

[student@workstation ~]$ lab start sa-archives-review
[student@workstation ~]$ cat ~/sa-archives-review/README

Build the tree and the backup on servera

[student@workstation ~]$ ssh root@servera
[root@servera ~]# mkdir -p /srv/project/docs /srv/project/data /srv/project/cache
[root@servera ~]# echo "Project readme" > /srv/project/docs/readme.txt
[root@servera ~]# seq 1 100 | sed 's/$/,record/' > /srv/project/data/records.csv
[root@servera ~]# echo "top secret" > /srv/project/secret.txt
[root@servera ~]# echo junk > /srv/project/cache/tmp.bin
[root@servera ~]# chmod 640 /srv/project/secret.txt
[root@servera ~]# setfacl -m u:student:r /srv/project/secret.txt
[root@servera ~]# mkdir -p /srv/backup
[root@servera ~]# tar -cJf /srv/backup/project.tar.xz --acls --selinux --xattrs --exclude=project/cache -C /srv project
[root@servera ~]# tar -tJf /srv/backup/project.tar.xz
project/
project/secret.txt
project/docs/
project/docs/readme.txt
project/data/
project/data/records.csv
[root@servera ~]# cd /srv/backup && sha256sum project.tar.xz > project.tar.xz.sha256
[root@servera backup]# sha256sum -c project.tar.xz.sha256
project.tar.xz: OK
[root@servera backup]# exit

-C /srv project stores the names project/..., and --exclude=project/cache leaves the cache out.

Carry it to serverb and verify

[student@workstation ~]$ ssh root@servera 'cd /srv/backup && tar -cf - project.tar.xz project.tar.xz.sha256' | ssh root@serverb 'mkdir -p /srv/restore && tar -xf - -C /srv/restore'
[student@workstation ~]$ ssh root@serverb 'cd /srv/restore && sha256sum -c project.tar.xz.sha256'
project.tar.xz: OK

The two files travel inside a plain tar stream, so no temporary file is needed on workstation.

Restore with metadata

[student@workstation ~]$ ssh root@serverb 'cd /srv/restore && tar -xJf project.tar.xz --acls --selinux --xattrs && ls -l project && getfacl -cp project/secret.txt'
total 16
drwxr-xr-x. 2 root root 4096 Oct  3 17:46 data
drwxr-xr-x. 2 root root 4096 Oct  3 17:46 docs
-rw-r-----+ 1 root root   11 Oct  3 17:46 secret.txt
user::rw-
user:student:r--
group::r--
mask::r--
other::---

The + and the student entry show that the ACL survived; there is no cache directory.

Grade

Check your work with lab grade sa-archives-review, then put the exercise away with lab finish sa-archives-review.